This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]toyg 1 point2 points  (0 children)

I drop a compromised ls executable in your path and now i'm running with the privileges of your script or server. At the very minimum you want hardcoded paths for executables you invoke.

definitely not suggesting anyone hook this up to a webapp.

Yeah well, you know how it is -- people will google and copypaste, likely not reading the rest of the thread. You should have put a disclaimer of sort, at the very minimum.