2

I was wondering, if I have a php script, which could upload a file, What if I inject it in a page which is vulnerable to Xss. So, I created one and Here is the code of index.php

<html>
    <body>
    <form action ="" method="GET">
    <input id="name" name="name">
    <input type="submit">
    </form>
    </body>
    <?php
    if(isset($_GET['name'])){
        echo $_GET['name'];
    }
    ?>
</html>

And, Here I have a Php Script, which I made to upload an Image on the server.

<html>
    <body>

    <form action="" method="post" enctype="multipart/form-data">
        Select image to upload:
        <input type="file" name="fileToUpload" id="fileToUpload">
        <input type="submit" value="Upload Image" name="submit">
    </form>

    </body>


    </html>

    <?php
    $target_dir = "./";
    $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $imageFileType = pathinfo($target_file,PATHINFO_EXTENSION);
    // Check if image file is a actual image or fake image
    if(isset($_POST["submit"])) {
        $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
        if($check !== false) {
            echo "File is an image - " . $check["mime"] . ".";
            $uploadOk = 1;
        } else {
            echo "File is not an image.";
            $uploadOk = 0;
        }
    }
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    // if everything is ok, try to upload file
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
            echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded.";
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
    ?>

Now, My question is: What if, I inject this script in a Page which is vulnerable to Xss?
P.S : I tried doing so, But I was getting redirected to a page and its URL was data:, I am unable to figure out the exact Problem. And, If not the way, I am doing, Is their any other way to do so ?

2

What if, I inject this script in a Page which is vulnerable to Xss?

That's not how it works. XSS means that you inject JavaScript code, not PHP code. If you would inject PHP code, and it would execute, it would be code execution, not XSS.

XSS is a vulnerability that happens client-side. It allows you to steal data that is known to the users browser - eg cookies -, to perform CSRF and thus do anything the attacker can do, and so on. Everything a website can do with JavaScript, you can do with XSS.

But you cannot change what happens server-side via XSS.

Of course, if the server does provide an image upload functionality, and it is vulnerable to XSS, you could upload a file via XSS, as you can send requests to the server via JavaScript. But in that case you do not change how the server works. You could just as well upload a file using a browser. The advantage here is that you may get someone else with more privileges to upload a file for you via XSS, via the already existing upload functionality.

1

It actually depends on which types of XSS Vulnerability it is, If it is a Reflected XSS Vulnerability then it wont work.

It might work if it is a Stored XSS Vulnerability on the website.

You might get more information on it here - Types of xss

Looking at your script , it is an Reflected XSS vulnerability , so it wont work.

  • It would be a stronger answer if you explained why different XSS types matter. You can edit your answer to add to it if you wish. (and welcome to stack exchange!) – Neil Smithline Mar 18 '16 at 4:09
1

I think you probably can't succeed with a PHP code injection from the example you have taken, which consist of just a php echo 'string datatype' in index.php.

Here your injected PHP code is already considered as a string datatype in $_GET variable. And it cannot be executed as PHP code in this example.

Even if the injected php code consists of eval() function like <?php eval(phpinfo()); ?> or eval(phpinfo()) the total of it will be considered a string and wont execute any PHP code on server.

Having said that, you can succeed with code injection if the original index.php script already had something like echo eval($_GET['name'];).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.