PHP Security Programming: Shell Command injection

Using system commands is a risky operation, especially if you are trying to use remote data to construct a command to execute. If the contaminated data is used, the command injection vulnerability is generated.

EXEC () is a function for executing shell commands. It returns the last line of Powerbet that executes and returns the command output, but you can specify an array as the second parameter so that each line of the output is stored as an element in the array. Use the following methods:

<?php$last = exec (' ls ', $output, $return);p Rint_r ($output); echo "return [$return]";? >

Assuming that the LS command is run manually in the shell, it produces the following output:

$ lstotal 0-rw-rw-r--  1 Chris Chris 0 12:34 php-security-rw-rw-r--  1 Chris Chris 0 may 12:34 CHRIS-SHIFL Ett

When running in exec () using the method of the previous example, the output is as follows:

Array (  [0] = total 0  [1] =-rw-rw-r--  1 Chris Chris 0 may 12:34 php-security  [2] =-rw-rw-r --  1 Chris Chris 0 12:34 Chris-shiflett) Return [0]

This method of running the shell command is convenient and useful, but this convenience poses a significant risk to you. If the contaminated data is used to construct the command string, the attacker can execute arbitrary commands.

I suggest that you avoid using shell commands if you can, and if you do, make sure that the data that constructs the command string is filtered and that the output must be escaped:

<?php$clean = Array (), $shell = Array (),/* Filter Input ($command, $argument) */$shell [' command '] = Escapeshellcmd ($cle an[' command '); $shell [' argument '] = Escapeshellarg ($clean [' argument ']); $last = Exec ("{$shell [' command '}} {$shell [' Argument ']} ", $output, $return);? >

Although there are several ways to execute a shell command, it is important to insist that only filtered and escaped data is allowed when constructing a running string. Other similar functions that need attention are passthru (), Popen (), Shell_exec (), and System (). I reiterate once again that it is advisable to avoid the use of all shell commands if possible.

PHP Security Programming: Shell Command injection