You are viewing a plain text version of this content. The canonical link for it is here.

Posted to bugs@httpd.apache.org by bu...@apache.org on 2005/01/03 01:15:06 UTC

DO NOT REPLY [Bug 32916] New: - People use query string to let server download any files they want

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=32916>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=32916

           Summary: People use query string to let server download any files
                    they want
           Product: Apache httpd-2.0
           Version: 2.0.52
          Platform: Other
        OS/Version: FreeBSD
            Status: NEW
          Severity: critical
          Priority: P1
         Component: All
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: liber_uo@yahoo.com.tw


People can use extra query string to let php execute
the command, example: wget
then system will download the file, and run it.

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org