It looks like the vast majority are from forks of PHP Vulnerability Hunter, and a few more are from other vulnerability tests. So I guess this isn't actually that common?
You thought that “This should never happen was bad”? search – eval($_GET)
11–16 of 16 posts
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#12Years ago I worked on a web app that had a "hidden" page that would do something like:
SQL.exec($_GET['sql'])
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#13Aren't those almost all "php-vulnerability-hunter – ArbitraryPhpGet.php" ? That seems like, well, not so bad.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#14I'm not familiar with PHP. Can someone explain this to a newbie?
The function eval[1] evaluates a string as code. The special variable $_GET[2] contains HTTP GET variables, which may be freely set by a remote user.
So if your PHP file executes eval($_GET['code']), then arbitrary folks can submit whatever code they want as a parameter -- as in /index.php?code=blah -- and have your webserver run it for them.
[1] http://php.net/manual/en/function.eval.php [2] http://php.net/manual/en/reserved.variables.get.php
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#15Try looking for database connections too.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#16Also bad https://github.com/search?utf8=%E2%9C%93&q=include%28%24_GET... There is a simple Google search that allows you to find thousands of websites that do this. Which I won't put since it essential gives you a list of websites ripe for take over.
Should be "include($_GET" (with quotes)