I have found a piece of this code in a web application (simplified):
<?php $password="very-secret-password"; $param = $_GET["param"]; ?>
<html> ...
Param: <?php echo $param; ?>
... </html>
I know that this is like a call to XSS, but I would like to know if attacker can run his own PHP code here. By this, I mean something like displaying the password - page.php?param=; ?><?php echo $password; ?>
, but specifically this did not work.
Googling and OWASP cheat sheets provided no information to this specific problem.
So, can attacker run his own PHP code here or it is not possible? If yes, how? (PHP v5.6)
$search
in the web app. However, it should not matter.