Does filtering HTML syntax prevent a web shell from being dropped through a textbox? [closed]

Question

I have an admin panel that is running off a mysql db. On that panel, I have text boxes that allow an "Admin" to input plain text OR HTML Styling that will be displayed on a section of the site that is live. So for example, A user might input the following in a Title textbox;

<b>The 'Rory' jumped over the moon</b>

The text boxes are set to only allow specific html syntax.

Does that prevent a web shell from being dropped on to the web server through the text boxes?

• Is there a way to bypass the filtering?
• If you manipulated the data in the DB, would it allow php to run?

Answer 1

It is very unlikely that this would be a viable route to dropping a web shell. The input is probably stored in a database, not in a file, so the interpreter (ASP, PHP, etc) will not process it as source code. A much more likely attack vector is Cross Site Scripting, if the filter is not strict enough.

EDIT to answer 2 points added later:

• There is no way to know if the filter can be bypassed without analyzing the source or attempting to bypass it.
• Understand how the PHP interpreter is invoked by the web server. In most cases, the web server calls the appropriate interpreter based on a file's extension (e.g. .php calls the PHP interpreter). The web server does not retrieve content directly from the database, so it cannot invoke the interpreter on database content. A vulnerability would exist if a PHP page retrieved user-defined strings from the database and eval'd them. I hope you can understand how unlikely such a situation would be.

Shortest form of this answer: Probably not, but try it if you don't believe me.