Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to pentest a PHP script.
This is the last line of the script that I want to exploit:
Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']);
Is it vulnerable to remote code execution? If so, I want to run the system function inside the base64_decode function:
system($_GET['cmd'])
Is it possible?
You should never say never, but there is no reason to believe you could exploit that line to gain RCE. The base64_decode function does exactly what the name implies - it decodes base64. To get the parameter value executed you would need a function that executes code provided to it, like eval. You don't seem to have that, so you are out of luck.
With that said, it looks like you could do path traversal, since there is no check for / characters. Not sure how you could exploit that in a redirect response, though. On older versions of PHP you could also do header injection by including a newline, thereby starting a new header.
The base64_decode() function is not risky by itself but running arbitrary code on your system is.
Having a script that calls system($_GET['cmd']) is almost an invitation for hackers to mess up your server. As soon as anyone skilled finds it, they will have loads of fun at your expense.
If you're worried about security in any way, you will never let your users decide what runs on your server.
systeminside base64 decode function"? Issystem($_GET['cmd'])code that is present already, or is that your desired payload? Could you give us a more complete view of the code you are trying to exploit? – Anders Jul 11 '16 at 7:52system($_GET['cmd'])! – I'm V Jul 11 '16 at 15:01base64_decodedoes not execute any code, so it seems impossible to me. – Anders Jul 11 '16 at 15:11