athena php website administration / News: Recent posts

Edward Z. Yang pointed out that athena is exploitable. Quick fix:

in athena.php, add the following code at the top of the file. Another (recommended!) solution is to run php in safe mode.
8<
if (!(strpos($athena_dir, "tp://") === false)) {
exit;
}
8<

--Exploit--

Language: PHP
Script: Athena
Version: 0.1a
Official website: http://sourceforge.net/projects/athena
Problem: Remote file inclusion
Discovered by: beford & ][GB][... read more

Initial content can be viewed using the CVS. A file release will happen somewhere in the next couple of weeks.

The athena project is now be hosted at sourceforge. Full transfer and release is planned to happen in the end of july 2004.