bugtraq - Re: php create_function commond injection vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <32316-30219@sneakemail.com>
Date: Mon, 29 Sep 2008 09:54:47 +0200 (CEST)
From: bzhbfzj3001@...akemail.com
To: bugtraq@...urityfocus.com
Subject: Re: php create_function commond injection vulnerability

On Thu, 25 Sep 2008, lmfao@...mail.com wrote:

> Are you kidding ?
>
> As the PHP manual said "if you use double quotes there will be a need to escape the variable names".
>
> In your example you use a function with double quotes, without escaping the variable $sort_by, so
> this is not a PHP vulnerability, but a development one.
>
> For this time, don't blame PHP, blame developers.
> It's like if I was using mysql_query() without escaping user's inputs...an sql injection, not a PHP vuln ;)
>
To be fair, this kind of api is obviously a disaster waiting to happen.

Use an array to express an array of arguments? No, we'll just use 
concatenated strings again, that never caused any problems with sql... I 
wonder why all other languages have that strange 'prepared statements' 
format, and they never get the sql injection bugs. It's unfair!

Anyone up for a bet when PHP will add some more 'magic_quotes' to fix 
this mistake?