Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82407
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.46 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54DAB43C.7040107@gmx.de>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
 <CAB6YZuxmMBQbVKYFcpH=2Yb0cOBoRSsZLritfV1-VkHrBm=Nbw@mail.gmail.com>
 <CAGa2bXbff7yQ_X5-9FVXNJzgOqVOpiO6h-OYFx=RMP5-f6X1QA@mail.gmail.com> <54DAB43C.7040107@gmx.de>
Date: Wed, 11 Feb 2015 10:50:13 +0900
Message-ID: <CAGa2bXaUaFy2LGy0qc=7gCBfX=bSTe9w4j8LWHsULe-hRWzEDw@mail.gmail.com>
To: Christoph Becker <cmbecker69@gmx.de>
Cc: =?UTF-8?Q?Pavel_Kou=C5=99il?= <pajousek@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11336798d30e86050ec63bf0
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11336798d30e86050ec63bf0
Content-Type: text/plain; charset=UTF-8

Hi Christoph,

On Wed, Feb 11, 2015 at 10:45 AM, Christoph Becker <cmbecker69@gmx.de>
wrote:

> > We have been tried to educate users already and introduced some
> > mitigations e.g. allow_url_include, open_basedir.
> >
> > However, enough time is passed to prove that wasn't enough, isn't it?
> >
> > PHP (many and these are _only_ few of them in the wild)
> >
> http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=PHP&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_exploit_text=inclusion&filter_port=0&filter_osvdb=&filter_cve=
>
> I've arbitrarily checked the top most entry (u5CMS), and the LFI was
> caused by `echo file_get_contents($_GET['...'])` basically.  There was
> neither include|require(_once) involved, nor move_uploaded_file().  From
> my, admittedly very limited, experience, this is a rather common source
> of LFI vulnerabilities in PHP applications.  I'm afraid that educating
> developers is the only way to avoid this kind of vulnerability.


It's not my point. These are only surface of them as you can see it contains
only open source project's vulnerabilities.

Script inclusion is common by evidence, unlike others.

This is what I'm trying to change.
Are PHP programmers are worse than others?
I don't think they are.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11336798d30e86050ec63bf0--