Re: Can anybody communicate with the operating system without the php server?

It's certainly possible, but how would they have found your directory? I
would triple-check my own script first to make sure there were no holes
before I started looking for zebras.

There are not so much to check. The only php-command which can save
files (or the only that I use) is "move_uploaded_file". Among all my
php scripts there is only one which contains this command. And the
command is used in the following way:

$uploadfile = $id."_tmp.jpg";
move_uploaded_file($_FILES['user_file']['tmp_name'], $uploadfile);

So, if a user uploads a file with the usage of my php-script it (file)
will be saved in my directory under a name which end with "_tmp.jpg".
However, in the directory I found I found files which ends with .php.
So I can conclude that a hacker either used another php script (not
mine) or could create a file in my directory without a usage of a php-
script.
.

Relevant Pages

  • Re: php zlib
    ... have been searching for a provider that allows zip compression through ... php scripts and now I have this instead. ... My goal is to be able to run a php script to compress and backup ... Spenlow, more like Punch than I had ever seen Jaimica, as Tremayne ...
    (comp.lang.php)
  • Re: exec() in the background
    ... existence, and when you create this file, the background script finds ... this file and then does a diecommand, or even better, if you need to ... I have not yet put php scripts into background proccesses, ... Even got it interacting with mysql so i ...
    (alt.php)
  • Re: exec() in the background
    ... existence, and when you create this file, the background script finds ... this file and then does a diecommand, or even better, if you need to ... I have not yet put php scripts into background proccesses, ...
    (alt.php)
  • php zlib
    ... have been searching for a provider that allows zip compression through ... php scripts and now I have this instead. ... My goal is to be able to run a php script to compress and backup ... gzwrite($zp, $data); ...
    (comp.lang.php)
  • Re: Can anybody communicate with the operating system without the php server?
    ... php scripts there is only one which contains this command. ... if a user uploads a file with the usage of my php-script it ... So I can conclude that a hacker either used another php script (not ...
    (comp.lang.php)