Search code examples
phpsecurityinjectexploit

Can I inject php code in the url in part thats displayed on screen?

Hey this is my very simple code: 

<?php
$test= $_GET['test'];
echo $test;

?>

And in the url I wrote this:

test.php?test=system('dir')

Why does it not execute the command and why is it not displayed?

Solution

  • You're passing the command as a string in the URL. Furthermore you're simply "echo-ing" the string to the screen. While an echo could include escaped php code which would be run, you might instead want to evaluate and run the command.

    To actually run the command you can use either of the following commands:

    Make sure to read the documentation of safe-mode-exec as well. Especially the following bit:

    safe_mode_exec_dir string If PHP is used in safe mode, system() and the other functions executing system programs refuse to start programs that are not in this directory. You have to use / as directory separator on all environments including Windows.