I'm wondering whether my architecture poses a security risk. Details:
The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions.
I have a folder "user_files" that may hold any kind of user files. For example, a ksh unix file.
My php.ini disables the exec php function (as well as some other sensitive functions)
My question is simple yet bears 2 aspects:
- could somebody execute the uploaded script?
- what is the magnitude of the risk? If the script is executed by apache I guess the maximum it could do is to delete all apache owned files of the server, right?