I uploaded the sni.php to another server that I own and played around with it. It allows you to upload, download and edit files on on the server. so if they can find config.php they can download it and view it's contents (ie db login/pw) and then use the sni.php to enter the login/pw to access the db. It also allows you to use sendmail, FTP (if login/pw known) and some other stuff.. it can be very damaging in the wrong hands.
|