0

I want to know that How eval function can be dangerous for any web application's Security?

Below is the code I use to understand when any user input passes to the eval function, then How an attacker can exploit it?

<?php

$x = @$_GET['arg'];

eval("\$y = \"$x\";");
echo $x;

?>
  • it's more-or-less the same as allowing .php file uploads from any user. – dandavis Feb 9 '18 at 7:26
3

Ok, first imagine that I send this request:

script.php?arg=foo

Your eval then looks like this:

$y = "foo";

But if I send this:

script.php?arg=";%20echo%20exec('whoami');%20//

This turns your code into this:

$y = ""; echo exec('whoami'); //";

Which executes the "whoami" command on the server and prints the result. The // comments out the end part of your original code so it gets ignored and my code runs successfully.

This is an incredibly trivial remote code execution bug to exploit.

  • 1
    Wow, I just try this after your payload "; echo system('dir'); // And I said "fuck really". Now I got how it can be dangerous. Thanks @Polynomial – Utkarsh Agrawal Feb 8 '18 at 12:41
  • Yup. You can just run any arbitrary PHP, and thus any arbitrary system commands, via this. – Polynomial Feb 8 '18 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.