4 ms·
A very interesting exploit. This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick th
by tshadwell 13y ago
A very interesting exploit.
This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met." doesn't seem to be present in the linked documentation (http://www.php.net/manual/en/language.types.string.php http://www.php.net/manual/en/language.types.string.php), however. Does anyone know what these "prior mentioned requirements" might be?
- randomdrake 13y agoThe actual quote from the manual, that they appear to be referencing, is: Internally, PHP strings are byte arrays. As a result, accessing or modifying a string using array brackets is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1. It seems like they just replaced: is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1. ...with... will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met.
- tshadwell 13y agoBut multi-byte safety is one thing, and executing arbitrary code is another. It's still not an explanation of how you go from injecting a deformed string to executing code.