Incorrect # annotator parsing for some hosts in php

RAyh4c Black Box

Some interesting problems found.

 

The vulnerability code is:

If (! File_exists ($ this-> logFile) {file_put_contents ($ this-> logFile, "# <? Php exit ()?> ");}

The program is lazy and only writes the first line of the log file with the PHP suffix # <? Php exit ()?>, I thought it would be okay to write anything later.

 

The official explanation is:

Http://bbs.shopex.cn/read.php? Tid-160492.html

This patch mainly resolves the incorrect # annotator parsing of some hosts in php. This explanation is a bit funny. programmers should blame host annotator for improper parsing =.

 

The real reason is that the programmer did not consider the CGI situation of PHP. Generally, the first line of the cgi program needs to declare the path of the cgi interpreter, as follows:

#! /Usr/bin/perl

So even if php web programs adopt the CGI Mode, if the first line contains the #, this line will not be parsed by PHP code.

 

In addition, this principle can be extended to ngnixIIS class cgi script name Vulnerability (http://www.80sec.com/nginx-securit.html) a more accurate scan policy:

 

For example, visit the ROBOTS http://www.discuz.net/robots.txt of the disczu forum, you can see the first line.

Access in this form of http://www.discuz.net/robots.txt/xx.php, if the CGI Mode PHP, then the first line of # Will be eaten, basically can accurately determine the existence of the server vulnerability, to avoid misjudgment of Content-Type: text/html is 404.