One of the more ingenious PHP exploitation techniques from the early days wasn't a vulnerability by itself. It was the realization that two seemingly harmless weaknesses could be chained together into remote code execution.
Back when Local File Inclusion (LFI) vulnerabilities were everywhere, attackers discovered that web server log files could become an unexpected attack vector. Every HTTP request gets written to a log, including headers like the User-Agent. If an application contained an LFI vulnerability and the server allowed those log files to be included by PHP, the contents of the log could end up being interpreted as PHP instead of simple text.
The interesting part wasn't the LFI itself. It was the combination of an LFI bug, writable log files, and PHP parsing an included file that turned what looked like a simple file disclosure issue into something much more dangerous.
This became one of the classic examples of exploit chaining and changed how many developers viewed web security. It wasn't enough to fix individual bugs anymore. You had to think about how independent weaknesses could interact with each other. Modern frameworks and hardened server configurations have made this particular attack far less common, but it's still one of my favorite examples of how creative attackers used to think.
Some of the older PHP exploits may seem primitive compared to today's attack chains, but they laid the foundation for many of the defensive practicies we take for granted now.
Basically, to make this simple to understand, you made sure the code was logged and then used the log file as your included (LFI) file to execute the malicious code.
wormy
"Check everything"