subdomains + suexec = security hole (cpanel)
- linux-based
- cgi enabled
- suexec enabled.
You have a webspace on that server and you created sub.mdomain.com for your friend.
He can then upload some file manipulation cgi scripts to his webspace (under your webspace) and then read/alter all files own by you, even outside his designated webspace. Because the cgi script he upload will be run as you (the user who owns all yours and his files)!
When you create the subdomain through your control panel, the new web account (yourdomain.com/subdomain) will be created and will be run as "you".
So,whenever you're giving someone a subdomain, awebspace under yours, you accept the risk and consequences of what he's gonna do because what he's gonna do will be in your name..
I tried and can read files outside the server's webroot (/sbin/somefolder) as long as I have a symbolic link in my subdomain root to the outside folder. and the /sbin/somefolder owned by the user that gave subdomain space.
