News for hackers. Stuff that matters.

A comment on Exec($_GET. Parent comment

Re:Exec($_GET by robbles on Tuesday April 29, 2014 @03:20AM (#7665482)
It would still be vulnerable to a CSRF attack. The attacker can just get a logged-in user to launch their exploit, through a vulnerable site they frequent or even a link or image in an email.
[ Parent | on HN ]
Re:Exec($_GET by blueskin_ on Tuesday April 29, 2014 @04:20AM (#7665685)
Theoretically, building CSRF protection in isn't mutually exclusive with passing unsanitised variables to a shell. Although sure, most people who do the latter won't do the former.
[ Parent | on HN ]