Security aspects concerning code written in the programming language PHP which is often used for web applications.

learn more… | top users | synonyms

0
votes
1answer
14 views

PHP registration script, how to check if request is coming from a credible source

I've got a php registration script, that just takes all the data as a post request. I've got another page which sends that data to the script using jQuery ajax. How can i be sure, that the request ...
0
votes
0answers
14 views

PHP: decrypting a file directly to a stream using the defuse/PHP_encryption library

I have for a while been using the excellent Defuse PHP Encryption library for storing encrypted data strings in a database. I have an extension of this need where I now have files that need to be ...
2
votes
2answers
110 views

What is the meaning of this possible malware?

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am ...
0
votes
0answers
19 views

sql - Select boolean strictly true [on hold]

I want to select a row Ad as boolean which is strictly true. I am using the following SQL statement. SELECT 'user' AS username, 'pass' AS password, true AS Ad FROM users LIMIT 1; However the above ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
0
votes
1answer
39 views

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible?

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible? Let's say we have the following URL https://example.com/product.php?id=1&action=show Now example....
1
vote
4answers
79 views

How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.
2
votes
0answers
52 views

How can I protect my PHP app against XSS?

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones ...
1
vote
1answer
146 views

Is simple authentication safe if over HTTPS?

Background For my app I need to know if users have entered the correct email password combo. Pretty common stuff. I'm using HTTPS, and salting and hashing the passwords. Question Now, what I am ...
-1
votes
2answers
89 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
3
votes
1answer
90 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
0
votes
2answers
101 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
6
votes
1answer
219 views

SQL Injection through addslashes

I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose. After reading this topic and this topic, I try to understand how it can bypass ...
0
votes
2answers
122 views

Remote code execution vulnerability in PHP's base64_decode?

I'm trying to pentest a PHP script. This is the last line of the script that I want to exploit: Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']); Is it ...
0
votes
1answer
67 views

Best approach to get user's IP

There is two approaches: First approach: if (isset($_SERVER['HTTP_CLIENT_IP'])) $user_ip = $_SERVER['HTTP_CLIENT_IP']; else if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])) $user_ip = $_SERVER['...
1
vote
1answer
53 views

How can I track IPs to block malicious users?

TL;DR: I want to know should I store both REMOTE-ADDRESS and X-FORWARDED-FOR or either REMOTE-ADDRESS or X-FORWARDED-FOR? Details... Here is a few theories to get user's IP Theory1: If you don't ...
1
vote
1answer
42 views

RCE in a PHP script that doesn't have write permissions

So i've found a RCE vulnerability in a PHP script (it's in a file called viewfile.php). Basically, from this file I can execute whatever PHP code I want, for example, <?php echo phpinfo(); ?> ...
0
votes
1answer
83 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
1
vote
2answers
117 views

SQL Injection not working when I think it should

I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
-1
votes
0answers
23 views

Is this PHP code vulnerable to some attack? [migrated]

So I've made a PHP code for a login form. But i am not sure if this code was that safe, because i am not a security expert. I am using PDO statements in my code, here's my code : <?php class ...
1
vote
2answers
56 views

What cookie request is a suspect request?

I have this table which is containing all users' cookies: (about being login. that's actually "remember me checked") // cookies +----+---------+-------------------+------------+ | id | user_id | ...
0
votes
0answers
21 views

Restrict Excecution Access [migrated]

Lets say we have multiple domains in the same hosting account. The tree is like: home->website1 home->website2 home->website3 The problem is that website3 or website2 can contain a php or js file ...
-1
votes
1answer
67 views

Do I need to detect user's device for “remember me” system? [closed]

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
125
votes
9answers
22k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
1
vote
0answers
92 views

Obfuscated PHP code found in WordPress core files and plugins

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
0
votes
2answers
148 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
-6
votes
2answers
55 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
0
votes
2answers
96 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
1
vote
4answers
49 views

Remove possibility to read system files with PHP from Apache

When I upload a php file (file.php) with following content on Apache server <?php $file = $_GET['file']; include ( $file); ?> I am able to read any file of Apache using the below URLs http://...
0
votes
2answers
121 views

Can an SQL injection attack happen if the input is only allowed to be hexadecimal characters?

I've set up a login system that works more or less like this: 1) The user enters the data 2) The data is hashed locally using SHA256 (To reduce the risk of someone stealing the password through a ...
4
votes
1answer
75 views

Getting subscribers on website from nowhere?

I have a weird question and I hope I am asking in the right place. Recently I checked some statistics on my website after a while and noticed that the number of email subscribers had jumped from about ...
3
votes
3answers
413 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
0
votes
0answers
19 views

How can I create many-to-one keys in Doctrine/Zend/PHP?

I'm using Zend with Doctrine 2 to store data in a database. For a given user, I encrypt the data with a randomly-generated key specific to that user, and encrypt the key with that user's password ...
1
vote
1answer
122 views

How can I control all my website's requests? [closed]

I need to manage my website's requests. Because of both I need to detect suspect requests and block that IP and calculate the number of users which visit my website. So I've created a table like this:...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
0
votes
1answer
90 views

Virus suspicion on website built with PHP Codeigniter [duplicate]

I have received a website, which uses Codeigniter, to modify. The problem is, sometimes when I refresh the main page, a strange file named "download" with the Windows icon will start to download. I'm ...
1
vote
1answer
463 views

Using htmlentities() in a BBCode-supporting textarea to stop XSS

I want to have a text area to post stuff to the database with BBCode. So, I downloaded a JavaScript code (to write in the specific BBCode when the image is clicked) but it didn't transform the text. ...
1
vote
0answers
37 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
3
votes
2answers
64 views

How to accept user input for use in terminal safely?

I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified. // Get ...
4
votes
1answer
132 views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
5
votes
1answer
88 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
4
votes
3answers
167 views

Is this PHP code vulnerable SQL injection?

Im given control over the $vote variable (in the "challenge" function) Is there any way to sql inject the query? (BTW I can see/read whatever the challenge function returns e.g. the sql errors. I ...
4
votes
1answer
147 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
2
votes
1answer
162 views

How to bypass PHP username and password check in this CTF challenge?

I'm preparing for this CTF challenge I'll be participating in next week, and I ran across this problem online which I can't manage to solve. I only have control of the variables $user and $pass that ...
39
votes
7answers
5k views

Exploiting MD5 vulnerability in this PHP form?

I've been practicing in security-related topics and I came upon this problem which I don't understand at all. You receive a form with one input named pass, and this is the code you need to bypass: &...
-4
votes
3answers
64 views

How to pass website firewall, in PHP? [closed]

Recently, I have posted a question, (http://stackoverflow.com/questions/37494896/how-to-save-file-from-url-to-web-server-by-php). And, there is an answer in question. In this answer, he said: "So the ...
1
vote
2answers
87 views

How does a PHP application get nulled and how to avoid it

As so many others, I've been a victim of having a PHP product of mine be nulled and put available on the internet to download freely. The purpose of this question is to try to make it more difficult ...
1
vote
1answer
97 views

Password Encryption For PHP 5.3 or Should We Update to 5.5+?

I'm trying to hash passwords for our company site. After testing on a local Apache server that has PHP 5.5.9 and everything working as expected, I went to test on our live server being hosted by ...