PHP Multibyte Shell Command Escaping Bypass Vulnerability
Wednesday, May 7th, 2008In PHP there exist two functions to escape shell commands or arguments to shell commands that are used in PHP applications to protect against shell command injection vulnerabilities. - escapeshellcmd() - escapeshellarg() Unfortunately it was discovered that both functions fail to protect against shell command injection when the shell uses a locale with ...