Testing PHP form injection

Question

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:

if( $_POST["var"] != "" ) {
    print "Current value: ".$_POST["var"]."\n";
}

But if I try to inject PHP code ("; print phpinfo();, " etc.) I just get it echoed back to me instead of executing it.

I'm aware of how to clean the input using htmlspecialchars, addcslashes, mysqli_real_escape_string etc. but before I use them - what syntax do I need to successfully inject arbitrary PHP code?

I have noticed that my machine has the PHP Suhosin patch installed (Ubuntu 10.10) - would that be auto-escaping/sanitising my input for me?

Answer 1

For that code, I wouldnt expect to get PHP injection, but I'd look at Cross-Site Scripting (XSS) instead.

For example, try injecting:

<script> alert('woot Security.SE rulez!');</script>

Answer 2

"PHP Injection" isn't possible unless your application is using include(), require(), eval(), create_function(), or any of those similar functions that invoke the interpreter. Or if your application writes out to files in PHP's path that end with .php, .phtml, or any other PHP registered file extensions.

As pointed out by AviD, though, markup and script injection are definitely possible in your example.

Try downloading "Tamper Data"... it's an Add-on for Firefox that it makes laughably easy to perform injection attacks against a web application. It even has some built-in default attacks that you can try, in case you're not aware of any yourself!

Answer 3

Just FYI I wouldn't consider using stripcslashes as it could also cause XSS.

Let me explain: stripslashes vs stripcslashes

stripslashes removes all backslashes regardless of type

stripcslashes will remove all backslashes except hex characters, so what this means is that you could perform an XSS attack on a function that uses stripcslashes by doing something like this:

\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3e\\x61\\x6c\\x65\\x72\\x74\\x28\\x27\\x58\\x53\\x53\\x21\\x27\\x29\\x3b\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e

Which when evaluated by the stripcslashes function will result in : alert('XSS!');

This was actually a vulnerability I found within a popular Wordpress plugin (Platinum SEO <= 1.3.7)

Just make sure you do your research on the functions you are using before you use them as you could be causing more issues than it's worth.

This also applies to your usage of addcslashes() as you could force it to evaluate code where you don't want it to, like so:

$>php -r 'echo addcslashes("\x41", "A..z");' 
\A   

And here is a basic example of that in use for a malformed XSS string:

> php -r 'echo addcslashes("\x3c\x73\x63\x72\x69\x70\x74\x3e\x61\x6c\x65\x72\x74\x28\x27\x58\x53\x53\x21\x27\x29\x3b\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e", "/");'   
<script>alert('XSS!');<\/script>

As you can see, that would still execute the alert.

As mehaase confirmed, there is no possible way of invoking PHP code without using something like include(), require(), eval(), system() (You've got more worries if you are using system() on user input than PHP Arbitrary code execution).