8 ms·
> but fastcgi_params does not put attacker controlled data into environment variables it does https://gist.github.com/anonymous/ea60dc2915eccf0b803e https://g
by moduloo 12y ago
> but fastcgi_params does not put attacker controlled data into environment variables
it does
https://gist.github.com/anonymous/ea60dc2915eccf0b803e https://gist.github.com/anonymous/ea60dc2915eccf0b803e
- xorcist 12y agoIt looks like you have dumped the a PHP global variable, possibly $_ENV. Do you know of any circumstances where _ENV, or any other PHP variable with potentially untrusted data, is passed in environment variables?
- moduloo 12y agoi'm working on it it, but it looks like it works only under rare conditions