Examples of vulnerable PHP code? [closed]

Answer 1

Basic (often security sensitive) operations not working as expected, instead requiring the programmer to use a second "real" version to get non-broken functionality.

The most serious one of these would be where an actual operator is affected: The "==" operator does not work as one would expect, instead the "===" operator is needed to get true equality comparison.

One of the big 3 PHP forum packages was affected by a vulnerability in it's "stay logged in" code. The cookie would contain the user's ID and their password hash. The PHP script would read and cleanse the ID, use it to query the user's correct hash in the database, and then compare it with the one in the cookie to see if they should be automatically logged in.

However the comparison was with ==, so by modifying the cookie, an attacker use a hash "value" of boolean:true, making the hash comparison statement useless. The attacker could thus substitute any user ID to log in without a password.

Answer 2

Oh boy, you won't be short of examples. Just Google PHP tutorial and every single one of them has enough holes to fill the Albert Hall.

Result 1, w3schools. What's their first example to include user input?

Welcome <?php echo $_POST["fname"]; ?>!<br />

Bzzt. HTML injection, repeated throughout every piece of example code. What's their first database query?

$sql="INSERT INTO Persons (FirstName, LastName, Age) VALUES ('$_POST[firstname]','$_POST[lastname]','$_POST[age]')";

Bzzt. SQL injection, you lose. Next.

Result 2, official PHP tutorial. What's the first example of outputting a variable?

echo $_SERVER['HTTP_USER_AGENT'];

Bzzt. HTML injection. Not an easily-exploitable one, but still, bad practice of the sort that is repeated throughout php.net's learning materials.

Result 3, tizag.com. What's the first example of echoing user input?

echo "You ordered ". $quantity . " " . $item . ".<br />";

Bzzt.

Result 4, freewebmasterhelp.com. Too basic to include much, but still manages:

print "Hello $name"; // Welcome to the user

Bzzt.

Result 5, learnphp-tutorial.com.

<title><?= $greeting ?> World!</title>

Bz...

I could go on.

Is it any wonder the general quality of PHP code in the wild is so disastrous, when this woeful rubbish is what coders are learning?

Answer 3

SQL injection is easy:

$var = $_POST['var'];
mysql_query("SELECT * FROM sometable WHERE id = $var");

This is easily solved by:

$var = mysql_real_escape_string($_POST['var']);

The other common one is XSS (cross site scripting):

$var = $_POST['var'];
echo "<div>$var</div>\n";

allows you to inject Javascript that is run from your site. There are several ways of dealing with this, for example:

$var = strip_tags($_POST['var']);

and

$var = filter_var($_POST['var'], FILTER_SANITIZE_STRING);

Answer 4

Allowing people to upload files, whether that API is supposed to be used by users or not. For example, if a program uploads some files to a server, and that program will never upload a bad file, that's fine.

But a hacker could trace what is being sent, and where to. He could find out that it is allowing files to be uploaded.

From there, he could easily upload a php file. Once that's done, it's game over. He now has access to all your data and can destroy or change anything he wants.

Another common mistake is allowing flooding. You should put some sane limits on your data. Don't allow users to input nonsensical data. Why is a user's name 2MB in length? Things like that make it so easy for someone flood your database or filesystem and crash the system due to out of space errors.

Answer 5

Today's DailyWTF:

if(strstr($username, '**')) {

    $admin = 1;
    $username = str_replace('**', '', $username);
    $_SESSION['admin'] = 1;

} else {

    $admin = 0;

}

Answer 6

Email header injection attacks are a much bigger pain in the neck then you might suspect (unless you've had to deal with them).

This is very bad:

$to = 'contact@domain.com';
$subject = $_POST["subject"];
$message = $_POST["message"];
$headers = "From: ".$_POST["from"];
mail($to,$subject,$message,$headers);

(code copied from the second reference above.)