Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82406
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.22 as permitted sender)
Message-ID: <54DAB43C.7040107@gmx.de>
Date: Wed, 11 Feb 2015 02:45:32 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, =?UTF-8?B?UGF2ZWwgS291xZlpbA==?=
 <pajousek@gmail.com>
CC: "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com> <CAB6YZuxmMBQbVKYFcpH=2Yb0cOBoRSsZLritfV1-VkHrBm=Nbw@mail.gmail.com> <CAGa2bXbff7yQ_X5-9FVXNJzgOqVOpiO6h-OYFx=RMP5-f6X1QA@mail.gmail.com>
In-Reply-To: <CAGa2bXbff7yQ_X5-9FVXNJzgOqVOpiO6h-OYFx=RMP5-f6X1QA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: cmbecker69@gmx.de (Christoph Becker)

Yasuo Ohgaki wrote:

> We have been tried to educate users already and introduced some
> mitigations e.g. allow_url_include, open_basedir.
> 
> However, enough time is passed to prove that wasn't enough, isn't it?
> 
> PHP (many and these are _only_ few of them in the wild)
> http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=PHP&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_exploit_text=inclusion&filter_port=0&filter_osvdb=&filter_cve=

I've arbitrarily checked the top most entry (u5CMS), and the LFI was
caused by `echo file_get_contents($_GET['...'])` basically.  There was
neither include|require(_once) involved, nor move_uploaded_file().  From
my, admittedly very limited, experience, this is a rather common source
of LFI vulnerabilities in PHP applications.  I'm afraid that educating
developers is the only way to avoid this kind of vulnerability.

-- 
Christoph M. Becker