Hi all,
I'm using a pretty well known and respected webhost, as is a colleague of mine.
We are both on the same webserver as are many others.
This morning he discovered that if you know...
- the account name
- filename + path
- variable name
...you can display the value, simply by including the file. So for WordPress it will most likely be...
<?php
include("/usr/www/users/USERNAME/SITENAME/wp-config.php");
echo DB_PASSWORD;
?>
In addition to this (which is more worrying to me) he was able to use the PHP implode function to display the PHP source of any of my pages...
<?php
$data = implode('',file('/usr/www/users/USERNAME/SITENAME/index.php'));
echo $data;
?>
...which could then be used to read through the entire site's code (get the database config/database username/password).
Tell me this isn't normal/right!? Is there anything that can/should be done?
