# nginx + php-fcgi : 0day exploit ?

- Thread: https://externals.io/message/48379
- Original archive: https://news-web.php.net/php.internals/48379
- Started by jerome@loyet.net on 2010-05-21T19:58:53+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #48379 — jerome@loyet.net — 2010-05-21T19:58:53+00:00

URL: https://externals.io/message/48379#48379

Hi guys,

On the nginx mailing list, there is an interesting conversation about
the usage of php through fastcgi with nginx which can cause a security
hole:
http://forum.nginx.org/read.php?2,88845

I don't really know the origin of the fix_pathinfo ini variable. So I
don't know if it's really a bug or a mis-configuration.

What do you think ?

++ Jerome

---

## #49184 — Ferenc Kovacs — 2010-07-30T08:08:50+00:00

URL: https://externals.io/message/48379#49184 · In reply to: #48379

2010/5/21 Jérôme Loyet <jerome@loyet.net>:
> Hi guys,
>
> On the nginx mailing list, there is an interesting conversation about
> the usage of php through fastcgi with nginx which can cause a security
> hole:
> http://forum.nginx.org/read.php?2,88845
>
> I don't really know the origin of the fix_pathinfo ini variable. So I
> don't know if it's really a bug or a mis-configuration.
>
> What do you think ?
>
> ++ Jerome
>
> --
> 
> 
>
>

bump.

Tyrael