PHP Security vulnerabilities

1 Command execution

The following functions can be used in PHP to execute external applications or functions

System, exec, PassThru, shell_exec, Popen

system function prototypes

string System (stringint & $return _var])
Parameters:
　　　command

The command to execute.

　　　　return_var

If a return_var parameter is supplied, the return state after the execution of the external command is set to this variable

return value:

Success returns the last line of the command output, and failure returnsFALSE

exec function prototype

PassThru function prototypes

Shell_exec function prototypes

Popen function prototypes

System Vulnerability Instance (Windows environment)

<? phpprint ("Specify the name of the dir to print");p rint (" <p> " ); $dirname=$_get[' dirname']; $rest=system ("  Dir $dirname", $return _var);? >

Request:

http://127.0.0.1/syscommad.php?dirname=c:\

Response:

Specify the name of the dir to print?????? C. keyboard?? Û?б???? ??????? К??? C038-3181C \??? ¼ ./ ./ at  -: A 1,024. Rnd -/ A/Geneva  on: theBurpsuitev1.6.24  -/ ,/ - Ten: -Drivers -/ the/ A  -: -IDAPro6.6  ./ ./ ,  A: -Ida_pro_v6.8_green ./Geneva/ +  -: -Java ./ ./ -  +: toMasm32 ./ ./ -  the: -Metasploit the/ -/ -  One: - 

PHP Security vulnerabilities