3

I want to know that How eval function can be dangerous for any web application's Security?

Below is the code I use to understand when any user input passes to the eval function, then How an attacker can exploit it?

<?php

$x = @$_GET['arg'];

eval("\$y = \"$x\";");
echo $x;

?>
1
  • it's more-or-less the same as allowing .php file uploads from any user.
    – dandavis
    Feb 9, 2018 at 7:26

1 Answer 1

6

Ok, first imagine that I send this request:

script.php?arg=foo

Your eval then looks like this:

$y = "foo";

But if I send this:

script.php?arg=";%20echo%20exec('whoami');%20//

This turns your code into this:

$y = ""; echo exec('whoami'); //";

Which executes the "whoami" command on the server and prints the result. The // comments out the end part of your original code so it gets ignored and my code runs successfully.

This is an incredibly trivial remote code execution bug to exploit.

2
  • 1
    Wow, I just try this after your payload "; echo system('dir'); // And I said "fuck really". Now I got how it can be dangerous. Thanks @Polynomial Feb 8, 2018 at 12:41
  • Yup. You can just run any arbitrary PHP, and thus any arbitrary system commands, via this.
    – Polynomial
    Feb 8, 2018 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .