Let's just fix them: http://www.cng.edu/files/pointer.jpg.php?shak=rm%20pointer.j...
Exec($_GET
121–130 of 131 posts
Re: Exec($_GET
#122"We've found 99,841 code results" Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
As noted in other comment(s), there are legit uses for this.
Can you please provide just one? No other comment does that.
And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
Re: Exec($_GET
#123Earlier quoted context omitted.
As noted in other comment(s), there are legit uses for this.
Can you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
The sourcecode of a hypothetical Github commenting bot searching for this vulnerability will have the same search token, and will be flagged.
Re: Exec($_GET
#124Earlier quoted context omitted.
As noted in other comment(s), there are legit uses for this.
Can you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
A great example is: https://github.com/andresriancho/w3af-moth
He deliberately wrote vulnerable code to test his auditing script. There are more repos like this.
Re: Exec($_GET
#125Earlier quoted context omitted.
As noted in other comment(s), there are legit uses for this.
Can you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
Test cases for a PHP vulnerability scanner[1]
Re: Exec($_GET
#126Earlier quoted context omitted.
Can you please provide just one? No other comment does that. And to be clear, I'm talking about providing at least one legit use for passing user input directly to exec without any kind of filtering...
A great example is: https://github.com/andresriancho/w3af-moth He deliberately wrote vulnerable code to test his auditing script. There are more repos like this.
That's fair. But that's also the vast minority of these results that I can tell...
Re: Exec($_GET
#127Other examples primarily for Python, but also including Ruby and JavaScript:
- "eval(raw_input())" --> https://github.com/search?q=%22eval%28raw_input%28%29%29%22&...
- "eval(request" --> https://github.com/search?q=%22eval%28request%22&type=Code&r...
- "eval(request.POST" --> https://github.com/search?q=exec%28%24_POST&type=Code&ref=se...
- "eval(request.GET" --> https://github.com/search?q=%22eval%28request.GET%22&type=Co...
Re: Exec($_GET
#128This is awful. Shell commands are not guaranteed to be idempotent, people! These should all be of the form exec($_POST, not exec($_GET.
I think the problem here is the fact that tainted variables (user input) are used to execute shell commands. it doesn't matter if that's $_POST or $_GET, both of these are user input and therefore these are huge vulnerabilities.
I'm sorry, but I can't hear you over the sound of the joke flying overhead.
Re: Exec($_GET
#129Earlier quoted context omitted.
perl and ruby have "taint" which is similar to what you describe. And yes, this can be encoded in the type system and you can also make it so the sanitization is context dependent, i.e. http://www.comp.nus.edu.sg/~prateeks/papers/csas-ccs11.pdf
PHP does to http://pecl.php.net/package/taint but I haven’t used it or the perl/ruby ones so I'm not actually sure how similar they are...
How ironic.
Re: Exec($_GET
#130How about one with root access included? https://github.com/search?q=exec+sudo+%24_GET&type=Code&ref=...
Fortunately looks like most of those are home-automation/maintenance scripts.
Fortunately?? More often than we all care to admit, these things are exposed to the internet. (because it's so cool when I can turn on the coffee machine from my smartphone halfway home from work)