PHP MongoDB Injection _php Tutorial

The following is an introduction to the methods and principles of PHP+MONGODB injection

One of the posts said: login.php?username=admin&passwd[$ne]=1 may inject, just look at the time, I feel quite puzzled, this how there is an injection of loopholes, and finally from this post http:// The reason was found in the hi.baidu.com/hi_heige/item/ce93ce926dede4f428164747. Because PHP is able to submit an array directly, that is to say, it is a "$ne" index, I made a demo:

[PHP]
$passwd =$_get["passwd"];
Var_dump ($PASSWD);

$passwd =$_get["passwd"];
Var_dump ($PASSWD);
The test results are:

Array (1) {["$ne"]=> string (1) "1"}

That way.

[PHP]
$collection->find (Array (
"Username" = "admin",
"passwd" = Array ("$ne" = 1)
));

$collection->find (Array (
"Username" = "admin",
"passwd" = Array ("$ne" = 1)
));
It becomes the following:

[PHP]

$collection->find (Array ("username" + "admin", "passwd" = = Array ("$ne" + 1))); $collection->find (Array (
"Username" = "admin",
"passwd" = Array ("$ne" = 1)
));

If you change the link to this (username=[$ne]=1&passwd[$ne]=1), then all the user information will be retrieved.

The workaround for this bug is to cast the argument to the string type after getting the parameter:

[PHP]
$collection->find (Array (
"Username" = (string) $_get[' username '],
"Passwd" = (string) $_get[' passwd ']
));

$collection->find (Array (
"Username" = (string) $_get[' username '],
"Passwd" = (string) $_get[' passwd ']
); This is the same as executing the following MySQL statement, all injected

[PHP]

mysql_query ("SELECT * FROM Collection
WHERE username= "Admin",
and Passwd!=1

mysql_query ("SELECT * FROM Collection
WHERE username= "Admin",
and Passwd!=1
I did a demo test, and it worked.

http://www.bkjia.com/PHPjc/477615.html www.bkjia.com true http://www.bkjia.com/PHPjc/477615.html techarticle The following describes the next Php+mongodb injection method and principle of one of the post said: login.php?username=adminpasswd[$ne]=1 may inject, just look at the time, I feel very puzzled, this ...

