Re: [Phpwiki-talk] possibility of compromise of bug tracker, etc for SF projects running phpwiki

[Zot O'C. <zo...@wh...>]

On Mon, 2004-01-12 at 14:30, Robert Dodier wrote:
> Hello,

I guess the question is could phpwiki offer access to other resources.

I see a few possibilities:

1)  Access to files not available to the web interface, but available to
the web user.

2)  Access to databases via open connections and bad sql checking.

The first seems to be in the range of "any php script."

The second is nixed if the DB user the wiki uses is not the same as any
other DB user.


-- 
Zot O'Connor

http://www.ZotConsulting.com
http://www.WhiteKnightHackers.com