Hi all around here, this is a global problem in php - not only MODx.
If one will get access or do crazythings with/on your your webserver, then he always will penetrate a system with this lame lame php-shell.. this c99.txt exploit is some years old I think.
So if you have some very common settings in php.ini set, it’s like an wide opened door to a house with php, but php can be secure - even without things like safe_mode which may brings other problems.
So if you set some var’s in php.ini or via .htaccess then you can be aware of some stuff - here an example:
register_globals = off
allow_url_fopen = off
safe_mode = on
open_basedir = <path to web-root>
disable_functions = exec,system,passthru,shell_exec,popen,escapeshellcmd,proc_open,proc_nice,ini_restore
display_errors = off
Specialy this exploit makes use of some dangerous functions to do it’s work, as one might see’s in code from the exploit. It’s perhaps basicly better to secure your webserver, then only fix the problems in MODx.
