Bugtraq mailing list archives
Re: php create_function commond injection vulnerability
From: mnapier () slis indiana edu
Date: Mon, 29 Sep 2008 12:14:05 -0400 (EDT)
On Mon, 29 Sep 2008, bzhbfzj3001 () sneakemail com wrote:
On Thu, 25 Sep 2008, lmfao () hotmail com wrote:Are you kidding ? As the PHP manual said "if you use double quotes there will be a need to escape the variable names". In your example you use a function with double quotes, without escaping the variable $sort_by, so this is not a PHP vulnerability, but a development one. For this time, don't blame PHP, blame developers. It's like if I was using mysql_query() without escaping user's inputs...an sql injection, not a PHP vuln ;)To be fair, this kind of api is obviously a disaster waiting to happen. Use an array to express an array of arguments? No, we'll just use concatenated strings again, that never caused any problems with sql... I wonder why all other languages have that strange 'prepared statements' format, and they never get the sql injection bugs. It's unfair!
you mean like pg_prepare and friends? http://us2.php.net/manual/en/function.pg-prepare.php
Anyone up for a bet when PHP will add some more 'magic_quotes' to fix this mistake?
----------------------------------------- Mark E. Napier Director of Information Technology School of Library and Information Science Indiana University
Current thread:
- php create_function commond injection vulnerability root (Sep 25)
- <Possible follow-ups>
- Re: php create_function commond injection vulnerability lmfao (Sep 25)
- Re: php create_function commond injection vulnerability bzhbfzj3001 (Sep 29)
- Re: php create_function commond injection vulnerability mnapier (Sep 29)
- Re: php create_function commond injection vulnerability bzhbfzj3001 (Sep 29)
- Re: php create_function commond injection vulnerability Steven M. Christey (Sep 29)