Changes for page Application_PHP5

Last modified by Nicolas Gregoire on 2012/02/02 17:29

From 6.1 to 5.1

From version

edited by Nicolas Gregoire
on 2012/01/13 16:34

Change comment: Deletion of attachment create-file-via-libxslt.php

To version 1.1

edited by Nicolas Gregoire
on 2012/01/13 14:37

Change comment: There is no comment for this version

Summary

Page properties

Content

@@ -1,10 +1,6 @@
  Dixit [[Wikipedia>>http://en.wikipedia.org/wiki/PHP||rel="__blank"]] : "//PHP is a general-purpose server-side scripting language originally designed for web development to produce dynamic web pages. It is among one of the first developed server-side scripting languages that is embedded into a HTML source document, rather than calling an external file to process data. Ultimately, the code is interpreted by a web server with a PHP processor module which generates the resulting web page.//"
++Version 5 of this language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT.
--== Creating files ==
--Version 5 of the PHP language uses the [[libxslt>>Engine_libxslt]] engine to transform XML documents using XSLT. Prior to version 5.3.9, calls to libxslt were not restricted via xsltSetSecurityPrefs(). It was then possible to create / overwrite files on the engine side, typically for dropping a PHP Web Shell (cf [[Bug #54446>>https://bugs.php.net/bug.php?id=54446||rel="__blank"]]).
--
--
--The attached [[create-file-via-libxslt.php>>attach:create-file-via-libxslt.php]] PoC will drop a basic PHP script in /tmp/.