4

Is it possible to exploit this code?

eval ("\$RequestVariables = \$_REQUEST;");

or

eval ("\$ServerVariables = \$_SERVER;");

I know if $_REQUEST or $_SERVER wasn't an array and if it was a string or int it was possible to exploit it, but in this case its an array. Is it still possible to exploit this code?

3
  • How would you exploit it if $_REQUEST was a string or int?
    – Arminius
    Commented Feb 12, 2018 at 15:54
  • I did it like this eval ("$test = $something") and if something was 1111 ; echo 'pwned'; it executed my echo
    – JohnDoes
    Commented Feb 12, 2018 at 15:57
  • The bigger question is why the heck this is being eval'ed.
    – Polynomial
    Commented Feb 12, 2018 at 16:34

1 Answer 1

2

No, that's not exploitable.

All variables in the string you're passing to eval() are \-escaped, so they don't get expanded. This means you're always literally evaluating...

$RequestVariables = $_REQUEST;

...which is just an ordinary assignment without any possibility to inject your own code.

What if they were not \-escaped?

In that case you're still out of luck because $_REQUEST and $_SERVER are guaranteed to be arrays, and the string representation of an array is always just Array, not displaying any contained values.

2
  • Thanks. What if they were not \-escaped?
    – JohnDoes
    Commented Feb 12, 2018 at 16:19
  • 1
    @JohnDoes In that case I think you're still out of luck because $_REQUEST and $_SERVER just get expanded to "Array", giving you no chance to get your own payload inside the string.
    – Arminius
    Commented Feb 12, 2018 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .