4

Is it possible to exploit this code?

eval ("\$RequestVariables = \$_REQUEST;");

or

eval ("\$ServerVariables = \$_SERVER;");

I know if $_REQUEST or $_SERVER wasn't an array and if it was a string or int it was possible to exploit it, but in this case its an array. Is it still possible to exploit this code?

Improve this question
3
  • How would you exploit it if $_REQUEST was a string or int?
    – Arminius
    Feb 12 '18 at 15:54
  • I did it like this eval ("$test = $something") and if something was 1111 ; echo 'pwned'; it executed my echo
    – JohnDoes
    Feb 12 '18 at 15:57
  • The bigger question is why the heck this is being eval'ed.
    – Polynomial
    Feb 12 '18 at 16:34
2

No, that's not exploitable.

All variables in the string you're passing to eval() are \-escaped, so they don't get expanded. This means you're always literally evaluating...

$RequestVariables = $_REQUEST;

...which is just an ordinary assignment without any possibility to inject your own code.

What if they were not \-escaped?

In that case you're still out of luck because $_REQUEST and $_SERVER are guaranteed to be arrays, and the string representation of an array is always just Array, not displaying any contained values.

Improve this answer
2
  • Thanks. What if they were not \-escaped?
    – JohnDoes
    Feb 12 '18 at 16:19
  • 1
    @JohnDoes In that case I think you're still out of luck because $_REQUEST and $_SERVER just get expanded to "Array", giving you no chance to get your own payload inside the string.
    – Arminius
    Feb 12 '18 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.