News for hackers. Stuff that matters.
Re:Exec($_GET by blueskin_ on Tuesday April 29, 2014 @04:22AM (#7665693)
>They don't give unintended full access to the web server.

https://en.wikipedia.org/wiki/Webmin

Maybe not unintended, but definitely full access, and the world is almost certainly full of outdated/non whitelist access/weakly passworded panels.

Also, on a a sufficiently misconfigured server, you could always use \! (mysql's shell_exec, etc.) with phpmyadmin etc. to open a remote shell somewhere, then work from there.

There are no comments on this comment yet.