ID: 48231
Updated by: [email protected]
Reported By: root at 80sec dot com
-Status: Open
+Status: Wont fix
Bug Type: Scripting Engine problem
Operating System: *
PHP Version: 5.*, 6CVS (2009-05-11)
New Comment:
Yea. Right. And eval() is also very secure when passed unfiltered
input..
Previous Comments:
------------------------------------------------------------------------
[2009-05-11 02:53:18] root at 80sec dot com
Description:
------------
there is a commond injection in this function,you can EXECUTE your php
code directly but not CREATE a lambda-style function.It is very useful
when sometimes you can create a function but cann¡¯t call your
function.
Reproduce code:
---------------
<?php
$newfunc = create_function('', '};phpinfo();//');
?>
Expected result:
----------------
phpinfo executes runtime,needn't call newfunc.
Actual result:
--------------
phpinfo executes runtime,needn't call newfunc.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=48231&edit=1
