1

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the same page with some different values repeatedly:

http://example.com/libs/classes/securimage/securimage_show.php

I have used the Captcha code in the form with the following method:

<?php require_once('libs/classes/securimage/securimage.php');
 echo(Securimage::getCaptchaHtml()); ?>

Arachni scanner is showing the following message:

A modern web application will be reliant on several different programming languages.

These languages can be broken up into two flavours. These are client-side languages (such as those that run in the browser – like JavaScript) and server-side languages (which are executed by the server – like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server-side code should be executed by the server, it should never be seen by the client. However, in some scenarios, it is possible that:

The server-side code has syntax errors and therefore is not executed by the server but is instead sent to the client. Using crafted requests it is possible to force the server into displaying the source code of the application without executing it.

As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

Arachni has detected server-side source code within the server’s response.

(False positives may occur when requesting binary files such as images (.JPG or .PNG) and may require manual verification.)

I have tried to pass the session_id() in parameter to validate the class method. I also used another parameter to stop directly showing the captcha image in the URL but with no luck. What should I do to fix this problem?

Improve this question
2
  • 2
    This might be a false positive. Note that Arachni is telling you that this may trigger a false positive when requesting binary files such as images, which is exactly what Securimage does. The response is an image that it retrieves for you.
    – psosuna
    Mar 27, 2019 at 18:31
  • yes, it may be possible in my case. the code generate images from random array and get some parameters which do not allow the scanner to terminate checking...
    – Abdul Rahman
    Mar 29, 2019 at 5:55

2 Answers 2

Reset to default
2

(False positives may occur when requesting binary files such as images (.JPG or .PNG) and may require manual verification.)

This is telling you pretty much everything you need to know. You're including a binary file, and the scanner knows that it has trouble distinguishing between server-side source code and binary files.

It's safe to assume that this is a false positive.

Improve this answer
0

First of all, the provided code does have a syntax error:

echo(Securimage::getCaptchaHtml();

You either add another ) before the ; or remove the first ( since echo is not a function and using () with it is redundant.

If that doesn't fix the arachni error, what is the html output when you access that page directly?

Improve this answer
1
  • Sorry, this is my mistake when copy and paste the code. there is no syntax error, let me edit the code
    – Abdul Rahman
    Feb 25, 2019 at 12:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .