Security implications of execute perms on cmd.exe

[eddyboy]

Hi,

I've just installed Cacti, and i'm very impressed, however i don't like the idea of allowing the internet guest account execute permissions on cmd.exe. I realise this is an issue with the functions within PHP itself, but this certainly raises concerns over security.

Does anyone here think this is an issue? or am i just being paranoid?

Thanks.

[BSOD2600]

Yes, it's a big security issue.

I've created a seperate user account, which is used for the cacti portion of my website. IUSR has no rights on my cmd.exe but my cacti user does.