Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

2
votes
1answer
108 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
-2
votes
2answers
57 views

What sort of vulnerability is this?

I am testing one web application build using PHP. I found one vulnerability in which multiple user can log-in using same browser, without destroying others session. What this sort of vulnerabilities ...
2
votes
2answers
54 views

Writing errors to Apache's log file from PHP - are there any pitfalls?

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question ...
1
vote
1answer
315 views

How can I detect whether a webshell exploit has been run?

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files ...
1
vote
1answer
69 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
1
vote
1answer
44 views

How much access to the file system does the recent Drupal vulnerability give?

A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the ...
4
votes
1answer
1k views

Is this a backdoor?

I found the code below on my customers site. It looks like a typical backdoor hidden with hexadecimal, but I'm not 100% sure. <?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { ...
0
votes
1answer
102 views

Posssible hack on site?

I found a strange file on one of my servers containing the code below. The file was last modified one week ago at 1.40AM in the night, which is a bit odd. I have done lots of changes on this site ...
0
votes
3answers
979 views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
1
vote
1answer
53 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
4answers
163 views

How to exploit this include_once vulnerability in PHP?

I'm performing static analisys on a PHP code and came across with this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP ...
1
vote
1answer
64 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...
-2
votes
2answers
91 views

LAMP Stack Tiers - why?

What are the vulnerabilities mitigated by a tiered LAMP stack? As I understand it, any breach would allow access to the database even if it was tiered. What's the benefit? Are we better to ...
1
vote
2answers
326 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
1
vote
3answers
79 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
0
votes
0answers
162 views

Starting database security for web app that logs in with Facebook/Google JS SDKs

I have been making a web app that uses Facebook and Google JavaScript APIs to login (no email login) on the client side and currently it accesses a localhost MySQL database directly using PHP and ...
6
votes
2answers
926 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
3
votes
2answers
196 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
3
votes
4answers
112 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
0
votes
1answer
33 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
1
vote
1answer
290 views

Why add “***” in user-agent in this malicious code?

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site. $ua = $_SERVER['HTTP_USER_AGENT']; ...
0
votes
1answer
106 views

PHP sprintf vulnerability?

On some sites such as WriteCodeOnline, sprintf, vsprintf and other related formatted string functions are disabled for security reasons: Warning: vsprintf() has been disabled for security reasons ...
2
votes
1answer
100 views

Bypass Text Plain Rule

I want to know if I can allow uploading all types of scripts and add these rules to a virtual host configuration; so please advise and tell me if there will be some exploits that can be used to ...
0
votes
0answers
30 views

Exposing pm.status_path

Do you think it's dangerous to publicly expose PHP-FPM pm.status_path? It displays "Pool Status", "Active Processes status" and "Idle Processes status", showing Script path and Request URI.
6
votes
1answer
416 views

Two takes on PHP two way encryption - which one is preferable?

I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions... 1: The first one is derived from the official ...
1
vote
4answers
439 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
2
votes
2answers
82 views

Securing commands

For a project I'm working on, I need to securely send commands between servers. These commands should not be able to be altered, and there should be some security about not being able to just keep ...
3
votes
1answer
343 views

Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
2
votes
1answer
146 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
0
votes
1answer
57 views

Webserver has suspicious file

A webserver I know has this file which is "decrypted" to this file Now my question: What damage can this script do? And how could I inspect it correctly? (The compressed version needs a password and ...
-1
votes
1answer
59 views

Why injecting a php tag with XSS dosn't work? [closed]

So you all know about the XSS vulnerability but what I cannot understand is how come injecting a <?php ?> tag doesn't work? eg.: suppose there is a Stored XSS vulnerability in the index.php of a ...
1
vote
1answer
197 views

'Ghost' access to a php file on a web server

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them. ...
8
votes
5answers
5k views

Shellshock attack scenario exploiting php

I've seen attack scenarios involving using wget on cgi-scripts, but how about a scenario exploiting a web server php script that issues an exec() or system() call to a bash script? As far as I can ...
-3
votes
2answers
423 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
-3
votes
1answer
82 views

Feedback Form Exploitation possible or not? [closed]

how an attacker can exploit the below provided feedback form in a company website containing the company’s domain? the feedback form does not store data into a database. The server side code only ...
0
votes
2answers
157 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
1
vote
2answers
100 views

Should I validate authentication form inputs?

I've got a login page with a form where they can input their account's email address and password. I'm doing the following things before even attempting to authenticate a user: Validating the email ...
3
votes
1answer
114 views

Does FCGId use environment variables? (Or is it a possible attack vector for CVE-2014-6271/7169?)

According to Red Hat httpd (attack vector): CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the ...
10
votes
4answers
2k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
1
vote
1answer
123 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
5
votes
6answers
9k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
0
votes
2answers
56 views

Possible security issues with on demand generated image from database

I want to know what could be the potential risk with the displaying part of this behavior. For the upload part : 1- A form with a file upload for image. 2- Image content is save into Mysql ...
0
votes
0answers
37 views

Filter GET requests with regexp : Whitelist approach

I'm writing a new website with php, there is no backend but users will be able to input search terms through GET queries and I was wondering : is it safe to whitelist query parameters using regexp? ...
0
votes
1answer
84 views

Is addslashes + htmlentities sufficiently secure?

I have addslashes(htmlentities($userInput)). It gets inserted into my database. (NOT a mysql db) Is it sufficiently safe from xss? Thank you!
16
votes
6answers
4k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
1
vote
2answers
118 views

How To Patch LFI Vulnerability

I'm pretty sure that you all are aware of this vulnerability, but i wonder how to patch this? I have seen this code in a tutorial that it is the way to patch this but still user can access all the ...
1
vote
2answers
110 views

What permissions should I give to a MySQL 'user' that searches my database?

My site has a search form, which queries a few tables for whatever my end users want to find. What permissions should I give my MySQL user in order to search the database and update the 'times ...
2
votes
5answers
252 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
0
votes
2answers
70 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
2
votes
1answer
127 views

How to safely display external pictures?

i want to write (and currently writing) a php script to display external images, not hosted on my website. Something like facebook's safe_image. What I'm currently doing is file_get_contents('pic') ...