I think tumblr has a huge security hole

Re:I think tumblr has a huge security hole by drdaeman on Saturday March 19, 2011 @09:12AM (#2343507)

I believe you are wrong. include()/require() would equally happily display any file's contents outside of `<?php ... ?>` scope (the case with "i?php"), within document root or not.

Edit: I've tested this:

    $ php -v
    PHP 5.2.6-3ubuntu4.6 with Suhosin-Patch 0.9.6.2 (cli) (built: Sep 16 2010 19:51:25) 
    Copyright (c) 1997-2008 The PHP Group
    Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

    $ cat test.php
    <?php
        require "/tmp/test2.php";
    ?>
    $ cat /tmp/test2.php
    i?php
        define("TEST", "test");
    ?>
    $ GET http://localhost/test.php
    i?php
        define("TEST", "test");
    ?>

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:07AM (#2343605)

Off course, but in this case, passwords would only be exposed if the config file had a miss-typed opening PHP tag. If "test.php" had it, you wouldn't be able to see the contents of "test2.php".

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by drdaeman on Saturday March 19, 2011 @10:09AM (#2343606)

Yes, you are right. And in this exact case they (mis-)edited the file, that contained passwords (i.e. test2.php in my improvised example).

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:14AM (#2343618)

Sure, I was replying for this hypothetical situation that you guys ware discussing, where they would store passwords in a different file outside of webroot ...

[ Parent | on HN ]