PHP Vulnerabilities (I)-security issues of PHP websites

PHP websites are vulnerable to the following attacks:

1. Command Injection)

2. eval Injection)

3. Script Insertion)

4. Cross-Site Scripting (XSS)

5. SQL injection attacks)

6. Cross-Site Request Forgery (CSRF)

7. Session Hijacking)

8. Session Fixation)

9. HTTP Response Splitting attack (HTTP Response Splitting)

10. File Upload Attack)

11. Directory Traversal Vulnerability (Directory Traversal)

12. Remote File Inclusion attack)

13. Dynamic Function injection (Dynamic Variable Evaluation)

14. URL attack)

15. Form submission spoofing attack (Spoofed Form Submissions)

16. HTTP request spoofing attack (Spoofed HTTP Requests)

In the future, the principles and defense methods of these vulnerabilities will be introduced one by one in each issue.

Several important php. ini options:

RegisterGlobals

Php> = 4.2.0, the default value of the register_globals option of php. ini is set to Off. When register_globals

When set to On, the program can receive various environment variables from the server, including the variables submitted by the form, and PHP does not have to initialize the variable value in advance, which leads to a great security risk.

Example 1:

// Check_admin () is used to check the permissions of the current user. If the $ is_admin variable is set to true in admin, the following checks whether the variable is true and then performs management operations.

 
 

  
  
//ex1.php 
  
  
 if(check_admin()) 
  
  
{ 
  
  
$is_admin=true; 
  
  
} 
  
  
if($is_admin) 
  
  
{ 
  
  
do_something(); 
  
  
} 
  
  
?> 
 
 

This Code Section does not initialize $ is_admin to Flase in advance. If register_globals is On, then we directly submit the http://www.sectop.com/ex1.php? If is_admin = true, the verification of check_admin () can be bypassed:

Example 2:

 
 

  
  
// Ex2.php 
  
  
 If(Isset ($ _ SESSION["Username"])
  
  
{
  
  
Do_something ();
  
  
}
  
  
Else 
  
  
{
  
  
Echo"You have not logged on! ";
  
  
}
  
  
?>
 
 

When register_globals = On, we submit the http://www.sectop.com/ex2.php? _ SESSION [username] = dodo has the permissions of this user. Therefore, regardless of register_globals, we must remember that any transmitted data must be carefully verified and the variables must be initialized.

Safe_mode

Security Mode. PHP is used to restrict access to documents, access to environment variables, and control execution of external programs. Enable

For security mode, you must set safe_mode = On in php. ini.

1. Restrict File Access

Safe_mode_include_dir = "/path1:/path2:/path3"

Different folders are separated by colons.

2. Restrict access to environment variables

Safe_mode_allowed_env_vars = string

Specify the prefix of environment variables that PHP programs can change, for example, safe_mode_allowed_env_vars = PHP _. If the value of this option is blank, php can change any environment variable.

Safe_mode_protected_env_vars = string is used to specify the prefix of environment variables that php programs cannot change.

3. Restrict execution of external programs

Safe_mode_exec_dir = string

The folder path specified by this option affects system, exec, popen, and passthru, but does not affect shell_exec and ''.

Disable_functions = string

Different function names are separated by commas. This option is not affected by the security mode.

Magicquotes

It is used to automatically escape input information of php programs. All single quotes (""), double quotation marks ("), backslash (" \ "), and NULL characters (NULL ), are automatically added with a backslash to escape magic_quotes_gpc = On is used to set magicquotes to On, it will affect the HTTP request data (GET, POST, Cookies) programmers can also use addslashes to escape the submitted HTTP request data, or use stripslashes to delete the escape.