If a user on my server runs the following script it will show the passwd file but not the shadow file and if you change the commands to pretty much anything (ls, ls -la, rm -rf *) and it will execute the command. What do I need to change to take these permissions off the users using php or atleast off of php.
Script Example:
PHP Code:
<html>
<head>
<title>testing what php has access to</title>
</head>
<body>
This will show /etc/passwd:<br />
<pre>
<?
system("cat /etc/passwd");
?>
</pre>
<br />
done showing /etc/passwd
<hr /><br />
This will show /etc/shadow:<br />
<pre>
<?
system("cat /etc/shadow");
?>
</pre>
<hr /><br />
done showing /etc/shadow.
</html>
