My fav:
$device = $_GET['device']; $state = $_GET['state'];
exec( "sudo ./send " . $device . " " . $state );
EDIT: it is for home automation, but also appears to be a CS class group project.
Exec($_GET
61–70 of 131 posts
Re: Exec($_GET
#62My fav: $device = $_GET['device']; $state = $_GET['state']; exec( "sudo ./send " . $device . " " . $state ); EDIT: it is for home automation, but also appears to be a CS class group project.
I really, really, really want to post on their issue tracker, but maybe I shouldn't. There's no guarantee the person grading the project will care, either.
Re: Exec($_GET
#63Half the time these are just prototypes or throwaway projects or are behind password protected proxies. Relax people.
Paul's Security Weekly (a security podcast) had their blog owned after inadvertently removing the .htaccess (the password protection in your example) from their admin directory.
Re: Exec($_GET
#64Earlier quoted context omitted.
What if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
What about phpMyAdmin and others alike webapps? Are they inherently insecure?
[deleted]
Re: Exec($_GET
#65This is awful. Shell commands are not guaranteed to be idempotent, people! These should all be of the form exec($_POST, not exec($_GET.
It depends by the command, echo is idempotent for example. There should be some checking like
$cmdname = split(' ', $_GET['command']);
if(!in_array(IDEMPOTENT_COMMANDS, $cmdname))
echo 'Your request is not guaranteed to be idempotent. Please use a POST.';
else
exec($_GET['command'] ...Re: Exec($_GET
#66Re: Exec($_GET
#67Earlier quoted context omitted.
What if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
What about phpMyAdmin and others alike webapps? Are they inherently insecure?
Those are different, as they only do what they are meant to do (give access to the databases).
They don't give untintended full access to the web server.
That said, they are a little insecure.
Re: Exec($_GET
#68Example from the Github search: How to abuse: $_GET['name'] = "/dev/null; rm -rf /; echo ";
Wrong. `rm -rf /` fails without the `--no-preserve-root` option.
Re: Exec($_GET
#69"We've found 99,841 code results" Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.
I remember reading about something like this and Github their response was that the guy should stop according to their ToS. Their ToS blocks stuff like this to prevent spamming.