Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [php]

Security aspects concerning code written in the programming language PHP which is often used for web applications.

0
votes
0answers
2 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
2answers
43 views

After running a string through mysqli_real_escape_string, is it safe to remove the backslash before echoing it into a page?

I'm using a rich text editor (Nicedit) with a cms project I'm making. In order to reduce the likelihood of SQL injections, I'm using the mysqli_real_escape_string function to escape the user input ...
1
vote
0answers
25 views

Why `system` is not hide by these obfuscator of PHP [migrated]

I am recently trying to pick an obfuscator, I tried these I googled: https://www.gaijin.at/en/tools/php-obfuscator http://www.pipsomania.com/best_php_obfuscator.do https://www.tools4nerds.com/online-...
0
votes
1answer
88 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
-2
votes
1answer
39 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
28 views

How to filter HTML Event in Native PHP7

i want to creating xss filter for my own project, this is for html event filtering preg_replace("/ on\w+='[^']*'/i", '', preg_replace('/ on\w+="[^"]*"/i', '', $framed)); but considering to more ...
1
vote
1answer
70 views

Is a “logged_in” session flag secure enough?

Is the code below enough to secure a login area? <?php if ($_SESSION['logged_in']) { // show content for logged-in users } Note: $_SESSION['logged_in'] is just a boolean value true after ...
0
votes
0answers
11 views

Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini

I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/ But I cannot use wp-cli if I do that. Any solution please?
0
votes
0answers
18 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
0
votes
1answer
28 views

`$_GET[1]`; payload why work in php short tag only? [closed]

when I try to use this payload: <?= `$_GET['1']`; ?> it works in php-short-tag but when I do this: <?php `$_GET['1']`; ?> it's not working, and give me blank page. Can anyone explain ...
7
votes
1answer
164 views

Can I inject a shell command here in PHP?

During source code examination for a client, I found this code. It gets unsanitized parameter from GET, sanitizes it and does shell_exec() $arg = $_GET['arg']; // sanitization, I suppose... if(...
0
votes
1answer
30 views

Securimage php library for Captcha Code showing security issues in Arachni Scanner

I have used the securimage PHP library to show a captcha on my form. But when I'm scanning my page for vulnerabilities using Arachni scanner, it shows the following message and it's trying to scan the ...
-1
votes
0answers
14 views

can we copy the contents from iframe to another host?

i have a website called sub.example.com/dir1/dir2 which does not have the iframe option in response i am able to get all the content to iframe option in another site called clickjack.com my question ...
0
votes
1answer
43 views

How do I create comparable security to PHPmyadmin?

I have a website hosted by netfirms, and phpmyadmin is part of the package. It's a very powerful general tool, but it takes a while to load and there are some very long and specific tasks I need to ...
0
votes
2answers
111 views

Why not write the CSRF Token into the Session

I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
0
votes
1answer
44 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
0
votes
0answers
51 views

XenForo website hacked through PHP shell script

My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18). I'm not too experienced with backend stuff so I apologize if I use the wrong technical names. ...
0
votes
1answer
37 views

GDPR data minimisation session cookies

I have a research study being run. Participants are asked to; Fill out a consent form (contains personal information as per GDPR) Complete a questionnaire. My hopes was that the questionnaire ...
2
votes
0answers
55 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
0
votes
1answer
39 views

Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [closed]

I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization. TEST MACHINE xammp 1.7.3 for ...
0
votes
1answer
21 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
2
votes
1answer
56 views

PHP Code execution in function parameters and logical operators [closed]

After wondering about this and trying to better understanding, I tried the folowing code: is_string(3 and sleep(30)); Why PHP will execute code inside a parameter function (sleep in is_string) ? ...
2
votes
1answer
155 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
0
votes
0answers
127 views

How to extract and verify PDF signature (PKCS7) with openssl?

I would like to detect signed PDFs in PHP and verify if the signature is valid. From this document I have written this PHP code below. What it does is: Extract the PKCS7 code (it works because I ...
0
votes
2answers
83 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...
2
votes
1answer
74 views

Name of this cipher/encoding method?

I see a common method of encoding in PHP malware where there's some bytes of key, which gets used to decode that many bytes of encoded text. Decoded bytes get appended to the key on the fly. The ...
0
votes
1answer
52 views

Security for FTP connection within a server

In PHP, I am accessing another user's files using FTP on the same server. In this case, do I need to use secure FTP or is it ok to have normal FTP as both source and destination are on the same server?...
0
votes
0answers
72 views

PHP socks proxy with no port opening

let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port. Is there a way to do this exactly this : create a socks proxy on ...
0
votes
1answer
47 views

Cross subdomain PHP security?

I understand there are security risks with regards to cross subdomain session cookie attacks which are covered in other posts. However what about PHP script security? If a user with subdomain FTP ...
0
votes
0answers
58 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...
1
vote
1answer
151 views

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies ...
0
votes
2answers
68 views

PHP Code Injection vulnerability exists even after recommended hardening

Using Burp to intercept traffic and inject code we have identified remote code execution vulnerability in a website. After entering data in input fields on the form and clicking submit the traffic ...
0
votes
1answer
113 views

How to bypass the following PHP function [closed]

I need to write PHP code in an application in which I have access to the code, because it is a white box. However, I noticed that they use the following function: function stripbadchars($str_chain){ ...
0
votes
2answers
375 views

Strange GET request to my web application

I developed a Django application for a school project and I hosted it on an EC2 instance to test and learn the environment. During inspection of the logs, I found the following GET request, "GET /...
2
votes
2answers
134 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
1
vote
1answer
84 views

We saw URL-decoded PHP code. What does the code mean?

We saw URL-decoded PHP code that will probably try to take down our web servers via overflow attack, but we do not know exactly what it does. The decoded URL string is: /<?php echo chr(78).chr(69)...
3
votes
2answers
121 views

Possible SQLi with self-made prepared statements and real_escape_string?

My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird. $query = db::...
0
votes
1answer
160 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
1
vote
2answers
53 views

Sending order details in hidden input fields?

I'm developing payment extensions for multiple php based eCommerce platforms for a company that has their own payment processor (they just take post request; do couple checks and process it toward a ...
3
votes
2answers
89 views

Store database access password in PHP class const?

I have PHP project and I need to store MySQL access information. I have a config.php file outside public directory and in the file I have: class Config { const host = "dbserver"; const name =...
2
votes
1answer
168 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
1answer
53 views

Security implication of disclosing composer.lock?

What are the security implications in disclosing the composer.lock file for a remote, public known, web application?
1
vote
1answer
371 views

Reverse PHP shell disconnecting when netcat listener

Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565 Rather than rely on Metasploit or Meterpreter to ...
0
votes
1answer
81 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
1
vote
3answers
199 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
1
vote
2answers
517 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
0
votes
1answer
37 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
2
votes
0answers
121 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
6
votes
3answers
498 views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...
0
votes
1answer
81 views

Can I name a file .pl and run it as html on server? [closed]

I want to know if it is possible to name file .file.pl and run it as HTML. I want this to exploit CORS misconfiguration of a website which only checks origin header for .realwebsite.pl and we can add ...