| | code2html is a simple PHP script that converts Java, C, C++, Prolog, Perl, PHP, and others to HTML. The script uses GNU's source-highlight to produce the HTML code.
The archive also contains instructions explaining how to add code2html to phpbb (through bbcode).
| |
| | bug | Version 0.2 of the script is an excellent example of that how easy it is to write insecure PHP scripts. The script allows anybody to execute ANY code on the host machine. I kept that version online, so that you can get it and try it yourself. Can you find the exploit?
NOTE: DO NOT USE v0.2. GET THE LATEST ONE.
v0.2 exploit: Enter the following line in the 'Tabs' field:
2 < /tmp/pipein; ls -l; echo
| |
| | | |
|