You thought that “This should never happen was bad”? search – eval($_GET)
1–10 of 16 posts
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#2Actually I thought "This should never happen" was good. This is pretty bad, though.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#3Try looking for database connections too.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#4Actually I thought "This should never happen" was good. This is pretty bad, though.
Yea, it's people throwing in checks for cases that should never happen, but probably have saved a lot of money and time for people who were running those products.
This is just horrible.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#5Also bad
https://github.com/search?utf8=%E2%9C%93&q=include%28%24_GET...
There is a simple Google search that allows you to find thousands of websites that do this. Which I won't put since it essential gives you a list of websites ripe for take over.
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#6Thankfully, most of these I've seen in the first four pages are for things marked as a web shell, or a security scanner, etc, so it's purposeful and not meant for serious webapp use.
Still, kind of scary to see. It's like a listening netcat piping to bash in a loop. Sure there should be a firewall in front...
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#7Thankfully, most of these I've seen in the first four pages are for things marked as a web shell, or a security scanner, etc, so it's purposeful and not meant for serious webapp use. Still, kind of scary to see. It's like a listening netcat piping to bash in a loop. Sure there should be a firewall in front...
If you're going to be doing any of these, there should at least be some form of authentication within the project.
Leaving this open is just hoping someone runs "rm -rf /"
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#8I'm not familiar with PHP. Can someone explain this to a newbie?
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#9I'm not familiar with PHP. Can someone explain this to a newbie?
$_GET is a magic super global in PHP that contains all of the GET parameters of a request. Doing something like eval($_GET['code']); means you're essentially allowing a user to execute arbitrary code passed in through the URL. Not the safest thing to do...
Re: You thought that “This should never happen was bad”? search – eval($_GET)
#10I'm not familiar with PHP. Can someone explain this to a newbie?
It evaluates as PHP code the contents of the URL parameter named "code".
Although it seems like most hits are from PHP Vulnerability Hunter -- an automated whitebox fuzz testing tool capable of detected several classes of vulnerabilities in PHP web applications.