Авторизация
), this utility script was designed to help the framework execute code snippets. The problem? It uses a PHP function called to execute whatever is sent to it via an HTTP POST request. How the Attack Works When a website is misconfigured, the
#!/usr/bin/env php <?php eval(file_get_contents('php://stdin'));
Here's a high-level overview of the process:
Despite CVE-2017-9841 being , hundreds of sites remain vulnerable because:
), this utility script was designed to help the framework execute code snippets. The problem? It uses a PHP function called to execute whatever is sent to it via an HTTP POST request. How the Attack Works When a website is misconfigured, the
#!/usr/bin/env php <?php eval(file_get_contents('php://stdin'));
Here's a high-level overview of the process:
Despite CVE-2017-9841 being , hundreds of sites remain vulnerable because:
