In our enterprise we have several workers and collaborators. For the external collaborators, we have specific FTP accounts to restricted folders (test folders), and restricted access to MySQL database with priviledges. However, we have discovered that they can upload a PHP file with
system("rm -r *");
and it will perfectly work, for all paths, including at the top level of the FTP directory.
How can we prevent this from happening? Is there any way in some config file that we can have the above command to fail, and the need to use:
system("sudo -uUSER -pPASSWORD rm -r *");
so we will only give those user and password credentials to trusted collaborators, and the others can continue working without us being afraid of any fool play from their part?