111–120 of 131 posts
Are there any more sophisticated parses that also find the non-obvious cases? It should be easily doable to write a tool that finds an exec() of a variable that was assigned a $GET etc
I think it's easier to just avoid exec() altogether...
As a theoretical aside, I wonder if it'd be possible to have a typesystem based solution to these kinds of problems - where variables coming from the user (or from another program) are considered 'unsafe' and the compiler refuses to let exec() or whatever use them until they've been through a cleaner/tester of some kind... (OK, I know PHP doesn't have a compiler as such - but a static checker of some kind could work…
[0] https://github.com/riflon/Timantti/blob/2459c44fde2b378f63ac...
Maybe it's still an asinine error somewhat common, but i wouldn't take that search results as proof of how common it is...
Did someone else notice that that github search returns mostly results where exec is completely disconnected by $_GET? And that, i'd say, the last 20 pages contain the same thumbnail script that contains simply the "exec" string and multiple uses $_Get somewhere? Maybe it's still an asinine error somewhat common, but i wouldn't take that search results as proof of how common it is...
https://github.com/search?q=%22exec%28%24_POST%22&type=Code
vs.
Earlier quoted context omitted.
What about phpMyAdmin and others alike webapps? Are they inherently insecure?
Those are different, as they only do what they are meant to do (give access to the databases). They don't give untintended full access to the web server. That said, they are a little insecure.
is more the point you were trying to make, but yes.
Earlier quoted context omitted.
I think the problem here is the fact that tainted variables (user input) are used to execute shell commands. it doesn't matter if that's $_POST or $_GET, both of these are user input and therefore these are huge vulnerabilities.
I think he was indeed sarcastic.
This is awful. Shell commands are not guaranteed to be idempotent, people! These should all be of the form exec($_POST, not exec($_GET.
I think the problem here is the fact that tainted variables (user input) are used to execute shell commands. it doesn't matter if that's $_POST or $_GET, both of these are user input and therefore these are huge vulnerabilities.