Mochabomb

I found this out on accident – use nested includes to use shell_exec in WordPress and Drupal posts without any issues – I am using the Exec-PHP plugin.

* Tested with WordPress 2.1.2
* WordPress: Only works in Blog posts – not in a “page” – the PHP will not work.
* WordPress: Must use file path, not HTTP URL – see example below. URL’s will not work for the post.
* Drupal, tested as pages – works fine.

WordPress / Drupal Post text – use includes only:

<?php
include "/home/user/domain.com/ScriptDir/index.php";
?>

Contents of /home/user/domain.com/ScriptDir/index.php

<?php
include "/home/user/domain.com/ScriptDir/foo.php";
?>

Finally, the contents of /home/user/domain.com/ScriptDir/foo.php

<?php
shell_exec ( unix commands );
.. more verboten commands
?>