Writing Secure PHP Applications

PHP is a powerful scripting language for building web applications, and also one of the easiest ways for hackers to gain access to your web server. Developers need to understand how their scripts can be exploited in order to protect them.

One of the more popular attacks is the Cross-Site-Scripting technique. A hacker can exploit a poorly written PHP application by executing their PHP code on your web server.

The easiest way to demonstrate this vulnerability is to experiment with a PHP script with this problem. Place this script in your web server's document root. Don't forget to remove it when you are done with it!

hackme.php source

<a href="?page=home.php">Home</a> | 
<a href="?page=about.php">About</a>
<?php

$page = $_GET['page'];
if ($page)
	include $page;
else
	echo "Please specify a page.";

?>

The programmer can simply add links to new PHP pages in the HTML as they add page to the website:

But an attacker can modify the URL and do the same thing!

The hackme.php script will happily load the evilscript.php from the www.hacker.com web server, and execute it on your machine. You can try this example by placing the evilscript.php in the same directory as hackme.php and passing it's url to the hackme.php script:

evilscript.php source

<?php

system ('uname -a');

?>

This example will execute the uname command on your computer, giving the attacker information about what operating system you are running. They can then modify their evilscript.php to download a local root exploit specific to your operating system, and gain full access to your web server.

Fixing the hackme.php script

Basically, you want to remove the line that says 'include $page;' because it allows the attacker to load a page from anywhere on the internet. Instead, include php scripts only if they are listed in the switch statement.

<a href="?page=home.php">Home</a> | 
<a href="?page=about.php">About</a>
<?php

$page = $_GET['page'];
switch ($page) {
	case "":
	case "home.php":
		include "home.php";
		break;
	case "about.php":
		include "about.php";
		break;
	default:
		echo "Invalid page";
		break;
}

?>

Comments

Leave a Comment