Re: [PHP] Remote File Variable Injection Safety?

2009/1/7 Daniel Kolbo <kolb0057@xxxxxxx>:
suppose there is a file at http://otherhost.com/remote.php that looks like
this:

<?php
if (!isset($safe_flag))
{
die("hacking attempt");
}
echo "You are in";
?>

Suppose i executed the following php file at http://myhost.com/local.php

<?php
require_once("http://otherhost.com/remote.php";);
?>

Is there any way to get local.php to display "You are in", by only modifying
local.php? That is, is there a way to set $safe_flag on the remote host as
one requests a file from the remote host from within local.php?

I have genuine, academic, non-belligerent intentions when asking this
question.

Doing this is evil and should be avoided if at all possible. However,
assuming you really need to do it this way...

The best way to validate inclusion is to check the value of
$_SERVER['REMOTE_ADDR'] in the remote script and only allow known IPs.
This is not foolproof but will kill off casual attempts to get the
code.

Alternatively if you change the test for $safe_flag to
$_GET['safe_flag'] and add ?safe_flag=1 to the end of the URL in the
require call that should also work, but is easily copied. You could
randomise "safe_flag" and the value to make it more difficult, but
checking the IP is far better IMHO.

-Stuart

--
http://stut.net/
.

Relevant Pages

  • Re: extension loading works in command-line, but not Apache browser
    ... Here's the php file: ... echo "doesn't work!"; ... <HTML> ...
    (comp.lang.php)
  • Re: Text file splitter, date/time field
    ... large text file into which I have copied PHP file after PHP file, ... You appear to want to write code in a language that you do not know. ... Perl's regular expression in the documentation that came with perl. ...
    (comp.lang.perl.misc)
  • extension loading works in command-line, but not Apache browser
    ... all I'm trying to do is load the php_mapscript.so library into php. ... Here's the php file: ... echo "doesn't work!"; ...
    (comp.lang.php)
  • Re: Calling a php file from another on apache server
    ... shared systems have it disabled for security reasons. ... I want to call a php file that will access a database and return the results of its query into the web page so it looks seamless to the user. ... I tried putting it in cgi-bin, but that did not work because apache correctly won't allow a client into cgi-bin ...
    (comp.lang.php)
  • [UNIX] YaPiG add_comment.php PHP Code Injection
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... YaPiG is "a simple but powerful web album ... * YaPiG version 0.92b (Latest downloaded files appear to be immune to PHP ... This Proof of Concept creates a php file that echoes a notice. ...
    (Securiteam)