I'm pretty sure $login can be set to true/false somewhere on top of the file as ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

4mnt on June 24, 2014 | parent | context | favorite | on: Every C99.php shell is backdoored

I'm pretty sure $login can be set to true/false somewhere on top of the file as 'configuration'. Only it gets overwritten by the call to extract().

It was not meant to be user input

p4bl0 on June 24, 2014 [–]

I feel stupid. Of course, you are right.

heydenberk on June 24, 2014 | [–]

Don't feel stupid. This is difficult to reason about, hence the existence of the bug and the inadvisability of PHP's `extract` function.

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact