Date:         Mon, 12 Feb 2001 21:04:10 +0100
From: Peter van Dijk <peter@DATALOSS.NL>
Subject:      Re: Fwd: Re: phpnuke, security problem...
To: BUGTRAQ@SECURITYFOCUS.COM

On Mon, Feb 12, 2001 at 11:07:15AM -0000, Joao Gouveia wrote:
[snip]
> > > Example: http://www.phpnuke.org/opendir.php?requesturl=/etc/passwd

You can actually insert any URL instead of "/etc/passwd" and have it
read. Depending on the server's configuration, this could be abused to
execute PHP code, probably, and from that, any UNIX shell command.

The author obviously doesn't care about security.

Greetz, Peter.