Another Name of RCE is also called arbitrary code execution.Which is used to describe an attacker's ability to execute any command of the attacker's choice on a target machine or in a target process. It is commonly used in arbitrary code execution vulnerability to describe a software bug that gives an attacker a way to execute arbitrary code. A program that is designed to exploit such a vulnerability is called an arbitrary code execution exploit. Most of these vulnerabilities allow the execution of machine code and most exploits therefore inject and execute shellcode to give an attacker an easy way to manually run arbitrary commands. The ability to trigger arbitrary code execution from one machine on another (especially via a wide-area network such as the Internet) is often referred to as remote code execution.
For Example this one "CMD" which allow us to use the command prompt (in Linux it's Terminal):
and we can find these types of Websites using that error message :)
Just google this and open some websites ;)
Warning: system() [function.system]: Cannot execute a blank command.
This is Our Backend code which is vulnerable.
<?php
print system($_GET['cmd']);
?>
if u change the code to:
<?php
if(isset($_GET['cmd']))
{
print system($_GET['cmd']);
}
?>
it will be still same vulnerable because expert (pro) hackers check from every way.
