Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an admin panel that is running off a mysql db. On that panel, I have text boxes that allow an "Admin" to input plain text OR HTML Styling that will be displayed on a section of the site that is live. So for example, A user might input the following in a Title textbox;

<b>The 'Rory' jumped over the moon</b>

The text boxes are set to only allow specific html syntax.

Does that prevent a web shell from being dropped on to the web server through the text boxes?

  • Is there a way to bypass the filtering?
  • If you manipulated the data in the DB, would it allow php to run?
share|improve this question

closed as not a real question by rook, Iszi, Gilles, Terry Chia, this.josh Oct 26 '12 at 5:58

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

not enough information. – rook Oct 25 '12 at 14:49
up vote 5 down vote accepted

It is very unlikely that this would be a viable route to dropping a web shell. The input is probably stored in a database, not in a file, so the interpreter (ASP, PHP, etc) will not process it as source code. A much more likely attack vector is Cross Site Scripting, if the filter is not strict enough.

EDIT to answer 2 points added later:

  • There is no way to know if the filter can be bypassed without analyzing the source or attempting to bypass it.
  • Understand how the PHP interpreter is invoked by the web server. In most cases, the web server calls the appropriate interpreter based on a file's extension (e.g. .php calls the PHP interpreter). The web server does not retrieve content directly from the database, so it cannot invoke the interpreter on database content. A vulnerability would exist if a PHP page retrieved user-defined strings from the database and eval'd them. I hope you can understand how unlikely such a situation would be.

Shortest form of this answer: Probably not, but try it if you don't believe me.

share|improve this answer
There is a number of PHP based applications out there which store their configuration in a php file. And provide an admin panel to modify it... – Hendrik Brummermann Oct 26 '12 at 7:39
@HendrikBrummermann just when I thought PHP couldn't get any dumber... – bonsaiviking Oct 26 '12 at 14:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.