1

I didn't think so, but upon reading online it seems this type of code is vulnerable as I'm not ending with exit(); and could therefore be exploited by redirecting or changing the contents of the headers.

I've tried exploiting it using BurpSuite but was unable to redirect my headers to the login pages.

if ($status == 0)
    {
        header('location:index.php?status=fail');
    }
else
    {
        if ($_SESSION['level'] == 1)
        {
            header('location:basicuser');
        }
        if ($_SESSION['level'] == 2)
        {
            header('location:prouser');
        }
        if ($_SESSION['level'] == 3)
        {
            header('location:admin');
        }
    }
8
  • Hi there! Thanks for posting. However, we don't do general "is my code secure" code review type questions. Can you narrow your question down to a specific vulnerability or prevention technique? Thanks!
    – Ohnana
    Mar 22 '17 at 18:45
  • 1
    @Ohnana I've tried to improve my question!
    – popopret
    Mar 22 '17 at 18:58
  • What happens if someone goes to yoursite.example/admin when they aren't admin?
    – user253751
    Mar 22 '17 at 21:07
  • This code is awful. Please read PHP the right way and use a framework. Mar 23 '17 at 10:20
  • @AndréBorie the code is much much bigger but this is in login.php after checking user/pass
    – popopret
    Mar 23 '17 at 18:47
1

The issue with header redirects and exiting is that anything after the header redirect in the same script will still be executed.

You will not see it in a browser as you are being redirected, but you will see it in tools like burp or curl, which do not automatically follow a redirect.

If you do not actually execute any code after the header redirect, there is no issue (although it's best practice to just exit, as the code may change in the future).

Apart from that: you are using additional checks on the pages you redirect to, right? Because if not, an attacker could just enter them directly

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.