Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:

if( $_POST["var"] != "" ) {
    print "Current value: ".$_POST["var"]."\n";
}

But if I try to inject PHP code ("; print phpinfo();, " etc.) I just get it echoed back to me instead of executing it.

I'm aware of how to clean the input using htmlspecialchars, addcslashes, mysqli_real_escape_string etc. but before I use them - what syntax do I need to successfully inject arbitrary PHP code?

I have noticed that my machine has the PHP Suhosin patch installed (Ubuntu 10.10) - would that be auto-escaping/sanitising my input for me?

share|improve this question

3 Answers 3

up vote 8 down vote accepted

For that code, I wouldnt expect to get PHP injection, but I'd look at Cross-Site Scripting (XSS) instead.

For example, try injecting:

<script> alert('woot Security.SE rulez!');</script>
share|improve this answer
    
Confirmed, and fixed with htmlspecialchars. After consulting with our guru I'll rework it to a static page so I won't have to worry about it anyway. –  Andrew Feb 17 '11 at 1:51

Just FYI I wouldn't consider using stripcslashes as it could also cause XSS.

Let me explain: stripslashes vs stripcslashes

stripslashes removes all backslashes regardless of type

stripcslashes will remove all backslashes except hex characters, so what this means is that you could perform an XSS attack on a function that uses stripcslashes by doing something like this:

\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x27\\x58\\x53\\x53\\x21\\x27\\x29\\x3b\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e

Which when evaluated by the stripcslashes function will result in : alert('XSS!');

This was actually a vulnerability I found within a popular Wordpress plugin (Platinum SEO <= 1.3.7)

Just make sure you do your research on the functions you are using before you use them as you could be causing more issues than it's worth.

This also applies to your usage of addcslashes() as you could force it to evaluate code where you don't want it to, like so:

$>php -r 'echo addcslashes("\x41", "A..z");' 
\A   

And here is a basic example of that in use for a malformed XSS string:

> php -r 'echo addcslashes("\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x27\x58\x53\x53\x21\x27\x29\x3b\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e", "/");'   
<script>alert('XSS!');<\/script>

As you can see, that would still execute the alert.

As mehaase confirmed, there is no possible way of invoking PHP code without using something like include(), require(), eval(), system() (You've got more worries if you are using system() on user input than PHP Arbitrary code execution).

share|improve this answer
    
Oh wow, just realized this is a really old question, I don't know why it appeared at the top of my feed -.- Sigh. –  DarkMantis Sep 25 '13 at 11:24
    
no matter, it's useful info. –  Andrew Sep 26 '13 at 3:55

"PHP Injection" isn't possible unless your application is using include(), require(), eval(), create_function(), or any of those similar functions that invoke the interpreter. Or if your application writes out to files in PHP's path that end with .php, .phtml, or any other PHP registered file extensions.

As pointed out by AviD, though, markup and script injection are definitely possible in your example.

Try downloading "Tamper Data"... it's an Add-on for Firefox that it makes laughably easy to perform injection attacks against a web application. It even has some built-in default attacks that you can try, in case you're not aware of any yourself!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.