Can alter different site!

Ye' old general discussion board. Basically, for everything that isn't covered elsewhere. Come here to shoot the breeze, shoot your mouth off, or whatever suits your fancy.
This forum is not for asking programming related questions.

Moderator: General Moderators

Post Reply
User avatar
Jonah Bron
DevNet Master
Posts: 2764
Joined: Thu Mar 15, 2007 6:28 pm
Location: Redding, California

Can alter different site!

Post by Jonah Bron »

Hello, world!

After a series of tests, I found that I could alter a page on another domain I have, from nucleussystems.com with a php script. :banghead: It was just a simple php script, using relative addresses, to write new content to a txt file on the other site. Both are on the same domain.

If I were going to host websites, is there a way to avoid this?

Just want to alert the general public (of coders) to this issue.

Thanks!
P.S. can anyone else reproduce this process?
dayyanb
Forum Commoner
Posts: 46
Joined: Wed Jan 23, 2008 12:34 am

Re: Can alter different site!

Post by dayyanb »

Umm... wow.

Your file probably had write permissions for everyone, but still I would think the host should have some sort of protection against that.
Last edited by dayyanb on Mon Feb 18, 2008 1:11 pm, edited 1 time in total.
User avatar
Jonah Bron
DevNet Master
Posts: 2764
Joined: Thu Mar 15, 2007 6:28 pm
Location: Redding, California

Re: Can alter different site!

Post by Jonah Bron »

Wow is right. 8O
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: Can alter different site!

Post by Benjamin »

Even if the file had 0600 (-rw-------) permissions, since both files are owned and executed by the same user account either could write to the other.
User avatar
Christopher
Site Administrator
Posts: 13596
Joined: Wed Aug 25, 2004 7:54 pm
Location: New York, NY, US

Re: Can alter different site!

Post by Christopher »

I am guessing that the reason you can do what you did is because both of your sites use the same user account. It makes sense.
(#10850)
Post Reply