1

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:

https://example.com/image.php?image=cat.jpg

My image.php file contains

$image = $_GET['image'];

$file = file_get_contents('http://example.com/images/'.$image);

and then the contents of the image/file would be displayed on the page. Is there anyway that this may be exploitable? My research shows that it could be exploitable if the string was added in the suffix rather than prepended because that would allow a nullbyte to stop the file_get_contents function from reading more of the argument. But what if it's the other way around?

  • 2
    The null byte would only apply to PHP versie =< 5.3.x (not sure about the exact version) but PHP 5 should not be used anyway. – Jeroen Mar 20 at 19:31
  • Could you clarify what you mean by "But what if it's the other way around"? – Daisetsu Mar 20 at 20:43
  • indeed @Jeroen-ITNerdbox to be sure and safe you could consider to use $safe = str_replace("\0", '', $unsafe) to filter out null bytes on every user input.. – Raymond Nijland Mar 22 at 10:27
  • if the hard-coded site has any slow pages, it could be used to DOS you. – dandavis Mar 22 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.