Mochabomb

I found this out on accident - use nested includes to use shell_exec in Wordpress and Drupal posts without any issues - I am using the Exec-PHP plugin.

* Tested with Wordpress 2.1.2
* Wordpress: Only works in Blog posts - not in a “page” - the PHP will not work.
* Wordpress: Must use file path, not HTTP URL - see example below. URL’s will not work for the post.
* Drupal, tested as pages - works fine.

Wordpress / Drupal Post text - use includes only:

<?php
include "/home/user/domain.com/ScriptDir/index.php";
?>

Contents of /home/user/domain.com/ScriptDir/index.php

<?php
include "/home/user/domain.com/ScriptDir/foo.php";
?>

Finally, the contents of /home/user/domain.com/ScriptDir/foo.php

<?php
shell_exec ( unix commands );
.. more verboten commands
?>