Let's say that i have shared hosting and i want to secure that place, from executing shell commands. I'v installed suphp, so that users can execute PHP separately. I also did some other things in order to protect server (basedir and other recommended settings inside php.ini).
But the problem is still there: (i can execute and read config files from other websites)
<?php echo exec('cat /var/www/website/config.php'); ?>
If i disable exec function, still there are other ways to find out sensitive information from the server.
What can i do? Can i disable unix shell commands for specific user, will that take effect?
Edit: I'v changed premission on bin 754, before it was 755, and now users are unable to run shell commands using PHP. Is this a solution or not?