Possible attacks
    
     Using PHP as a CGI binary is an option for
     setups that for some reason do not wish to integrate PHP as a
     module into server software (like Apache), or will use PHP with
     different kinds of CGI wrappers to create safe chroot and setuid
     environments for scripts.  This setup usually involves installing
     executable PHP binary to the web server cgi-bin directory.  CERT
     advisory » CA-96.11 recommends
     against placing any interpreters into cgi-bin.  Even if the PHP
     binary can be used as a standalone interpreter, PHP is designed
     to prevent the attacks this setup makes possible:
    
    
     - 
      
       Accessing system files: http://my.host/cgi-bin/php?/etc/passwd
      
      
       The query information in a URL after the question mark (?)  is
       passed as command line arguments to the interpreter by the CGI
       interface.  Usually interpreters open and execute the file
       specified as the first argument on the command line.
      
      
       When invoked as a CGI binary, PHP refuses to interpret the
       command line arguments.
      
     
- 
      
       Accessing any web document on server: http://my.host/cgi-bin/php/secret/doc.html
      
      
       The path information part of the URL after the PHP binary name,
       /secret/doc.html is
       conventionally used to specify the name of the file to be
       opened and interpreted by the CGI program.
       Usually some web server configuration directives (Apache:
       Action) are used to redirect requests to documents like
       http://my.host/secret/script.php to the
       PHP interpreter.  With this setup, the web server first checks
       the access permissions to the directory /secret, and after that creates the
       redirected request http://my.host/cgi-bin/php/secret/script.php.
       Unfortunately, if the request is originally given in this form,
       no access checks are made by web server for file /secret/script.php, but only for the
       /cgi-bin/php file.  This way
       any user able to access /cgi-bin/php is able to access any
       protected document on the web server.
      
      
       In PHP, runtime configuration directives cgi.force_redirect, doc_root and user_dir can be used to prevent
       this attack, if the server document tree has any directories
       with access restrictions.  See below for full the explanation
       of the different combinations.