Question 228414 in PHP Question posted in
Official manual can be found here.

dealing with eval in PHP

Disclaimer: This is just an example to learn about PHP code injections and not production code used in any way. I am fully aware that this is not good coding practice.

I have the following PHP Script:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
  <head> 
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title>Sample Script</title>
  </head>
  <body>
    <h1>Sample page</h1>
    <p>Now doing the maths. Please enter a formula to compute. Example: 1+1.</p>
    <form method="get">
      <p>Formula: <input type="text" name="maths" /></p>
      <p><input type="submit" value="compute" /></p>
    </form>
<? 
  if (( isset($_REQUEST["maths"])) && ($_REQUEST["maths"] != "") )
    { 

      echo "<p>The result is: ";
      eval("echo (".$_REQUEST["maths"].");");
      echo "</p>";
    }
?>
  </body>
</html>

This script is vulnerable to PHP code injection and I can break it via (which I found out mostly via trial and error).

$a='1');phpinfo();echo($a

However, I don’t fully understand what is going on. From my understanding, I would need to finish the echo statement, insert my own code (e.g. phpinfo()) and then write another function (e.g. echo) to deal with the closing bracket.

I assumed something like this would work:

");phpinfo();echo("

However, this doesn’t work as an injection since phpinfo is treated as part of the string and doesn’t get evaluated by eval.
I also tried to escape the quotation marks, but to no avail.

Questions:

  • What is the proper way to inject code here?
  • Why does $a='1');phpinfo();echo($a work?
Tags:

2

Answers


  1. 0

    When you use that input, the result of substituting the variable is:

    eval("echo ($a='1');phpinfo();echo($a);");

    So this assigns $a='1', and echoes the result of that assignment (the value that was assigned to $a). Then it executes phpinfo(). And finally it echoes $a again.

    If you try to use );phpinfo();echo( it doesn’t work because it tries to execute echo (). But echo requires at least 1 argument.

    So to inject code here, you have to ensure that the input begins with something that will be valid after echo (, and it has to end with something that’s valid before );. Put the additional code that you want to inject between these two parts.

    Login or Signup to reply.
  2. 0

    The issue is that this statement is not valid:

    echo ();

    It gives a parse error. So you need to inject something that avoids it. Example:

    $var = "1); phpinfo(); echo (1";
eval("echo ($var);");
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search