PHP : Unsafe CGI usage

The application allows users to run PHP interpreter directly. This could allow an attacker to bypass authentication checks and gain access to protected files on the server.

If the PHP interpreter is installed as a CGI-Library, a Web server usually redirects requests to PHP resources to the interpreter.

Parameter cgi.force_redirect is enabled by default. If it is turned off, an attacker with an access to /cgi-bin/php can use PHP-interpreter permissions to gain access to arbitrary Web documents avoiding verification of access rights, which otherwise are provided by the server.