PHP File Injection?

Question

I have a script that calls a bash script that does some processing, but the script calls the bash script using user inputed data.

I am wondering if there is a way to make sure the person (it's a file upload) doesn't append like ;cd /;rm -rf * to the end of the file. Or anything else like that. Would a normal MYSQL Injection methods work? Is there a better alternative?

write your own scripting language that only provides the functionality you need to expose. — Daniel A. White
– Daniel A. White, Commented Jan 23, 2012 at 15:22
You don't let you PHP scripts run with root privileges, do you? — Mchl
– Mchl, Commented Jan 23, 2012 at 15:28
Don't pass user data on the command line, even if it's escaped. Use a bi-directional pipe to pass data to/from the external script. That completely eliminates any kind of shell injection vulnerability. — Marc B
– Marc B, Commented Jan 23, 2012 at 15:33

phihag · Accepted Answer · 2012-01-23 15:26:23Z

5

Being able to inject shell commands would be ... shell command injection, and neither file nor SQL injection. To secure against it, use escapeshellarg:

exec('bash bash-script ' . escapeshellarg($userInput));

answered Jan 23, 2012 at 15:26

phihag

289k75 gold badges475 silver badges489 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Andy · Accepted Answer · 2012-01-23 15:27:49Z

1

Did you check escapeshellcmd() and escapeshellarg() or am I missing the point?

answered Jan 23, 2012 at 15:27

Andy

2,1601 gold badge33 silver badges62 bronze badges

Comments

Christian · Accepted Answer · 2012-01-23 15:32:06Z

Securing this process is a two-way procedure:

ensuring the input meets some criteria (especially on maximum types)
ensuring the input cannot leak and change the process itself

Let's say I'm passing a number to a program...

$num = $_GET['num']; // get the input
$num = (int)$_GET['num']; // ensure it is an integer
$num = max($num, 0); // ensure it is at least 0
$num = min($num, 800); // ensure it is at most 800

$num = escapeshellarg($num); // this is overkill at this point, but you never know

exec('command '.$num);

As advised above, you can also have your own little language to do this but...

it may still be vulnerable
it may be overkill for a simple task
it is just an advanced version of the filter system

Finally, there's another alternative. There are functions that accept the command and parameters as separate arguments, such as popen() (you can push command arguments through pipes). But this depends on implementation.

Collectives™ on Stack Overflow

PHP File Injection?

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related