6

I have found a piece of this code in a web application (simplified):

<?php $password="very-secret-password"; $param = $_GET["param"]; ?>
<html> ...
Param: <?php echo $param; ?>
... </html>

I know that this is like a call to XSS, but I would like to know if attacker can run his own PHP code here. By this, I mean something like displaying the password - page.php?param=; ?><?php echo $password; ?>, but specifically this did not work.

Googling and OWASP cheat sheets provided no information to this specific problem.

So, can attacker run his own PHP code here or it is not possible? If yes, how? (PHP v5.6)

Improve this question
1
  • @drewbenn - Actually, it is called $search in the web app. However, it should not matter.
    – Vilican
    Dec 31, 2015 at 21:52

2 Answers 2

Reset to default
17

No, it's not possible to inject serverside code just via echoing CGI parameters. But as you say, it allows for a reflected XSS attack.

On the other hand, it's possible there may be other vulnerabilities in the code you did not include in your question.

Improve this answer
4

If you just echo the parameter, then the attacker can't inject any PHP code. But you make an XSS attack possible.

But if you eval($_GET["param"]), or eval any other code where you use one of the GET or POST parameters, then it is possible to inject PHP code.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .