The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Bulletin boards

— PHPBB, PHP-Nuke

■■

Administrative front ends

— PHPMyAdmin

■■

Web mail

— SquirrelMail, IlohaMail

■■

Photo galleries

— Gallery

50

Chapter 3 

■

Web Application Technologies

70779c03.qxd:WileyRed  9/14/07  3:12 PM  Page 50

---

■■

Shopping carts

— osCommerce, ECW-Shop

■■

Wikis

— MediaWiki, WakkaWikki

Because PHP is free and easy to use, it has often been the language of choice

for many beginners writing web applications. Further, the design and default

configuration of the PHP framework has historically made it easy for pro-

grammers to unwittingly introduce security bugs into their code. These factors

have meant that applications written in PHP have suffered from a dispropor-

tionate number of security vulnerabilities. In addition to this, several defects

have existed within the PHP platform itself, which could often be exploited via

applications running on it. See Chapter 18 for details of common defects aris-

ing in PHP applications.