Full Disclosure mailing list archives
Re: [WEB SECURITY] Re: Global Space Exploitation In PHP Based Web Applications
From: Aditya K Sood <zeroknock () metaeye org>
Date: Sun, 01 Apr 2007 01:43:09 +0530
Michal Zalewski wrote:
On Sat, 31 Mar 2007, Aditya K Sood wrote:http://zeroknock.metaeye.org/analysis/gspace.xhtmlJust like your previous "double trap" XSS advisory, I fail to see the novelty or significance of this report. You seem to discuss an ages-old issue that had been used to exploit a countless number of web applications, and is remediated by disabling register_globals (ain't that off by default since PHP 4.2.0?). /mz ---------------------------------------------------------------------------- Join us on IRC: irc.freenode.net #webappsec Have a question? Search The Web Security Mailing List Archives: http://www.webappsec.org/lists/websecurity/ Subscribe via RSS: http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
Well Nothing seems to be old. If it is still persisting with different layout than the attack vector is till persisting. It depends up on individual to look at the significance. There are number of people who finds it significant. I dont want to point it out but it comes in my and I thought its need attention again.Even after the specifier is off but still the vector is there may be due to any reason. Rest it depends on ones thinking. It needs attention again. Regards Adi _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Global Space Exploitation In PHP Based Web Applications Aditya K Sood (Mar 31)
- Message not available
- Re: [WEB SECURITY] Re: Global Space Exploitation In PHP Based Web Applications Aditya K Sood (Mar 31)
- Message not available