PHP Vulnerability Detailed _php tutorial

A few important php.ini options

Register Globals

The default value of the Register_globals option for Php>=4.2.0,php.ini is preset to off, and when Register_globals is set to ON, the program can receive various environment variables from the server, including the variables submitted by the form. And because PHP does not have to initialize the value of the variable beforehand, which leads to a large security risk.

Example 1:

Check_admin () is used to check the current user permissions, and if the admin setting is $is_admin the variable is true, then the following determines whether this variable is true and then performs some management actions

ex1.php

　　

if (Check_admin ())

{

$is _admin = true;

}

if ($is _admin)

{

Do_something ();

}

?>

This section of code does not initialize $is_admin to Flase, if Register_globals is on, then we submit http://www.sectop.com/ex1.php?is_admin=true directly, You can bypass the validation of Check_admin ()

Example 2:

ex2.php

　　

if (Isset ($_session["username"))

{

Do_something ();

}

Else

{

echo "You are not logged in!";

}

?>

ex1.php

　　

$dir = $_get["dir"];

if (Isset ($dir))

{

echo "

";
System ("Ls-al". $dir);
echo "

";

}

?>

　　

Mixed eval (string code_str)//eval injection typically occurs when an attacker can control the input string

ex2.php

　　

$var = "Var";

if (Isset ($_get["Arg"]))

{

$arg = $_get["arg"];

Eval ("$var = $arg;");

echo "$var =". $var;

}

?>

　　

http://www.bkjia.com/PHPjc/486002.html www.bkjia.com true http://www.bkjia.com/PHPjc/486002.html techarticle several important php.ini options Register Globals Php=4.2.0,php.ini The default value of the Register_globals option is preset to OFF, when the Register_globals setting is on, Program can receive from server ...

