0

There is understandably a lot of emphasis on sanitizing user input handed off to PHP on a web server and numerous opinions on doing it.

Can someone please confirm there is no security problems with the following PHP code which may compromise the server through an exploit:

if($_SERVER['QUERY_STRING'] == "kjg68KGH$88@kjhik8768"){
   $_SERVER['QUERY_STRING']=NULL;
   do stuff
} else {
   $_SERVER['QUERY_STRING']=NULL;
   do other stuff
}

or

if($_POST['the-var'] == "kjg68KGH$88@kjhik8768"){
   $_POST=[];
   do stuff
} else {
   $_POST=[];
   do other stuff
}

If there is (I do not see how there could be), then why?

  • I assume this is for some kind of CTF? Because you are hardcoding magic numbers – AdHominem Feb 3 '16 at 7:24
  • @AdHominem - A token yes, hardcoded in the example but just as easily a var i.e if($_POST['the-var'] == $whatever) and also possibly using a switch construct instead of if elseif else. Incidently the visibility of the query string or GET is not of itself a security issue. – Jenn Feb 3 '16 at 7:31
  • 1
    It's hard to say if it works or not when you don't know the context it is in and what it is supposed to do. – Anders Aug 19 '16 at 7:05
0

Using weak comparison in PHP is almost always a bad idea as it can lead to bugs and vulnerabilities. See here for an interesting example.

In your case, it should be mostly ok, although there are some corner-cases, eg "0x000000" == "000", "1e1" == "10", or "0xBEEF" == "48879".

Apart from that, there is no way to compromise the server with just the given code.

0

The code self is not secure, as most webservers are rfc2616 compliant. Rfc2616 is obsoleted by rfc7230. So a query with multiple query parameters with the same name are accepted. Wich one is presented to your code? If all, which one do you choose, based on what? Rfc7230 states such a request MUST be considered as an invalid request.

  • 2
    This answer is hard to understand. You do not clearly explain why the code is insecure. – schroeder Aug 19 '16 at 6:53
0

Example with a get request. Suppose you want to vote for Clinton https://..../vote.php?vote=Clinton

I send you a mail with a request to vote for Clinton with a link https://..../vote.php?vote=sanders&vote=clinton&vote=sanders

A non rfc7230 compliant webserver will accept this request. But what will be handed to php? The first vote=sanders or the last or all three as an array? You will you vote for? Most likely Sanders....

Of course you would not do this in a get, but use post. Also in a post you can add multiple parameters with the same name. A non rfc7320 compliant server will accept this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.