1

I was wondering, lets say we have a page like this.

<?php
if(isset($_GET['example'])){
echo $_GET['example'];
}

Would there be any way to exploit this page into doing something such as executing PHP, or accessing server files? Anything we can do with this example parameter?

I appreciate all answers, thank you very much.

1 Answer 1

7

This is a cross site scripting (XSS) vulnerability, which allows exploitation of the client (web browser) and cannot be used to (exploit php) compromise the website directly. It may however be possible to use this XSS as a staging point to attack other parts of the website, for example through hijacking an administrators session identifier or cross site request forgery.

1
  • I see exactly what you're saying now, thank you very much!
    – Andre
    Nov 25, 2015 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.