title: Exec() in PHP on Windows without opening up cmd.exe Security weakness?
body: <p>I have the requirement for a web script to execute an exe file and then return the results
  on the exe to the web request.</p>
  
  <p>I can either echo back the result of the exe or modify the exe to save it's results to a file, and then read the file to echo back the web request.</p>
  
  <p>The problem is that using php under IIS all exec() shell_execute() system() type functions  error out with 'Unable to fork' because the IIS anonymous user IUSER_%COMPUTER_NAME% does not have access to C:\windows\system32\cmd.exe</p>
  
  <p>This can be fixed by changing this IIS anonymous user's permissions for cmd.exe but
  this is significant security weakening (I believe).</p>
  
  <p>Is there any way I can have by PHP script under IIS call an Exe without opening up cmd.exe to the IIS anonymouse user ?</p>
  
  <p>Help appreciated.</p>
  
  <p>Why do I need to do this ?  I have a serial key generator, when somone buys my product via credit card my payment processor needs to call a url passing the license name as a parameter and having a serial number for that license name returned.</p>
  
  <p>My license key generator is WinLicense, which I have an an exe.</p>
  
  <p>I need to run something like</p>
  
  <p>shell_exec("C:\inetpub\wwwroot\test.com\testLicense.exe \"".$regName."\"");
  // or exec() or system()</p>
  
  <p>(testLicense.exe stores the result in a file which my php script can then echo)</p>