[ZZ] Exploiting PHP Self

Information Source: Phantom
Eric Butera emailed me with a very interesting topic about protecting against php_self exploits. I thought it might is a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL ' s is beyond me and it wouldn ' t take much work to filter out these malicious URL ' s in the PHP code .

For any of your that don ' t know, it's possible to inject code into php_self. It works by supplying a "/" after the actual PHP file and then entering your desired code. I ' ve done 4 test cases which show how it's possible to inject JavaScript and perform a redirect on code which doesn ' t filt ER php_self correctly.

Test Case 1

Injects data into a HTTP header, although this scenario is not very likely I thought I would include it to show that even Running Htmlentities or Htmlspecialchars won ' t save you from attack completely.

Test Case 2

Shows how easy it's to inject XSS into links, this is very likely as many PHP applications ofter refer to the same page T o Change the current action/display.

Test Case 3

A Search page often includes references to php_self and can is exploited as easily as links.

Test Case 4

Finally I show how code can is injected directly on the page without the need to break out of anything.

The test cases can be downloaded here:-
Test Cases

