Hacker News Reader

Comment by mlaux | Hacker News Reader

Typically seen more often as something like:

    http://example.com/viewPost.php?post=../../../whatever

(where the server side code has the bug, not the web server configuration itself)

View on HN

We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this.

Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

> Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.

That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.

Reply on news.ycombinator.com