Re:Do not use secrets in environment variables
by Dylan16807 on Monday October 07, 2024 @02:41PM
(#41769436)
That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.
Re:Do not use secrets in environment variables
by mschuster91 on Monday October 07, 2024 @02:37PM
(#41769400)
> Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.
This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.
Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.