Comment

Comment on

Yes, but from the page I linked

One really amusing thing in common with most of these “PoC"s is that they lean on “LFI”, or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It’s not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

For sure that this is still a bug that should be patched. But I do remember “don’t eval on user sent stuff” rule. Or is this really prevalent in PHP ecosystem?

source

Sort:hotnew top

i_am_not_a_robot@discuss.tchncs.de ⁨4⁩ ⁨days⁩ ago
Those PoCs are fake. You can exploit a page that just prints “hello.”

source
realitaetsverlust@piefed.zip ⁨3⁩ ⁨days⁩ ago

Or is this really prevalent in PHP ecosystem?

Not anymore.

You used to see eval a TON in like the early days, with like PHP 4 and 5. People just weren’t very experienced and PHP in itself had it’s limitations, and people worked around those by utilizing eval.

But modern PHP code rarely ever uses eval. Modern toolings like PHPMD even flag eval as an error, causing it to fail a pipeline if used in one. If you find eval in a codebase today, it’s either a badly modernized legacy one or written by a retard.

source
phoenixz@lemmy.ca ⁨2⁩ ⁨days⁩ ago
Dont use eval, period

If you use eval, you’re doing it wrong

source
- INeedMana@piefed.zip ⁨2⁩ ⁨days⁩ ago
  That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval
  
  source