Is your security analysis assuming that the attacker is running under a different uid than the web server? Why on earth would you do that?
In a secure shared hosting environment applications do not run as the web server UID. They run as the owner of the virtual host. Apache does this with mod_suexec.
Are you doing it differently? Why on earth would you do that?
In a secure shared hosting environment applications do not run as the web server UID. They run as the owner of the virtual host. Apache does this with mod_suexec.
Are you doing it differently? Why on earth would you do that?