The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Dynamic Execution in PHP

The PHP function 

eval

is used to dynamically execute code that is passed to the

function at runtime. Consider a search function that enables users to create stored

searches that are then dynamically generated as links within their user interface.

When users access the search function, they use a URL like the following:

https://wahh-app.com/search.php?storedsearch=\$mysearch%3dwahh

The server-side application implements this functionality by dynamically gen-

erating variables containing the name/value pairs specified in the 

storedsearch

parameter, in this case creating a 

mysearch

variable with the value 

wahh

:

$storedsearch = $_GET[‘storedsearch’];

eval(“$storedsearch;”);

In this situation, you can submit crafted input that is dynamically executed

by the 

eval

function, resulting in injection of arbitrary PHP commands into

the server-side application. The semicolon character can be used to batch com-

mands together in a single parameter. For example, to retrieve the contents of

the file 

/etc/password

, you could use either the 

file_get_contents

or the

system

command:

https://wahh-app.com/search.php?storedsearch=\$mysearch%3dwahh;

%20echo%20file_get_contents(‘/etc/passwd’)

https://wahh-app.com/search.php?storedsearch=\$mysearch%3dwahh;

%20system(‘cat%20/etc/passwd’)