|
|
Posted on 7/10/2015 8:28:51 PM
|
|
|
|
phpinfo()
Function description: Output PHP environment information and related modules, WEB environment and other information.
Hazard level: Medium
passthru()
Function description: Allows an external program to be executed and echoes output, similar to exec().
Hazard level: high
exec()
Function description: Allows the execution of an external program (such as UNIX Shell or CMD commands, etc.).
Hazard level: high
system()
Function description: Allows an external program to be executed and echoed output, similar to passthru().
Hazard level: high
chroot()
Function description: Can change the working root of the current PHP process, only if the system supports CLI mode
PHP, and this function does not work on Windows systems.
Hazard level: high
scandir()
Function Description: Lists files and directories in a specified path.
Hazard level: Medium
chgrp()
Function description: Change the user group to which a file or directory belongs.
Hazard level: high
chown()
Function Description: Change the owner of a file or directory.
Hazard level: high
shell_exec()
Function description: Execute commands through the shell and return the execution result as a string.
Hazard level: high
proc_open()
Function description: Execute a command and open the file pointer for reading and writing.
Hazard level: high
proc_get_status()
Function description: Get information about the process opened using proc_open().
Hazard level: high
error_log()
Function description: Send error messages to specified locations (files).
Safety note: In some versions of PHP, you can use error_log() to bypass PHP safe mode,
Execute arbitrary commands.
Hazard level: low
ini_alter()
Function description: It is an alias function of the ini_set() function, which has the same function as ini_set().
See ini_set() for details.
Hazard level: high
ini_set()
Function description: It can be used to modify and set PHP environment configuration parameters.
Hazard level: high
ini_restore()
Function description: Can be used to restore PHP environment configuration parameters to their initial values.
Hazard level: high
dl()
Function description: Load a PHP external module during PHP runtime, not at startup.
Hazard level: high
pfsockopen()
Function Description: Establish a socket persistent connection to an Internet or UNIX domain.
Hazard level: high
syslog()
Function Description: Calls the system-level syslog() function of the UNIX system.
Hazard level: Medium
readlink()
Function Description: Returns the content of the target file to which the symbol connection points.
Hazard level: Medium
symlink()
Function Description: Create a symbolic link in a UNIX system.
Hazard level: high
popen()
Function description: You can pass a command through the parameters of popen() and execute the file opened by popen().
Hazard level: high
stream_socket_server()
Function Description: Establish an Internet or UNIX server connection.
Hazard level: Medium
putenv()
Function description: Used to change the system character set environment while PHP is running. In PHP versions prior to 5.2.6, this function can be utilized
After modifying the system character set environment, use the sendmail command to send special parameters to execute the system SHELL command.
Hazard level: high
The disabling method is as follows:
Open the /etc/php.ini file,
Find disable_functions and add the name of the function to be disabled, as follows:
phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog, readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen |
Previous:Does your website Baidu still rank?Next:In C#, in the new version of Newtonsoft, Javascrip removed the workaround that tConvert could not find
|
Landlord|
Posted on 7/10/2015 9:02:17 PM
|
Posted on 9/24/2019 1:29:45 PM
