Every C99.php shell is backdoored

Re:Every C99.php shell is backdoored by 4mnt on Tuesday June 24, 2014 @05:34AM (#7936841)

I'm pretty sure $login can be set to true/false somewhere on top of the file as 'configuration'. Only it gets overwritten by the call to extract().

It was not meant to be user input

[ Parent | on HN ]

Re:Every C99.php shell is backdoored by p4bl0 on Tuesday June 24, 2014 @05:41AM (#7936855)

I feel stupid. Of course, you are right.

[ Parent | on HN ]

Re:Every C99.php shell is backdoored by heydenberk on Tuesday June 24, 2014 @07:21AM (#7937087)

Don't feel stupid. This is difficult to reason about, hence the existence of the bug and the inadvisability of PHP's `extract` function.

[ Parent | on HN ]