Sorry, I forgot to insert the initial question, here is it:
Roman Medina-Heigl Hernandez wrote:
> Hello,
>
> Last week I was thinking about the possibility for an external attacker to
> influence over the following PHP variable:
> $_SERVER['SCRIPT_NAME']
>
> The former variable contains the remote path (URI) to a PHP script, so if
> for instance you access with a browser to:
> http://<site>/aa/bb/cc/script.php
> Then SCRIPT_NAME will contain "/aa/bb/cc/script.php"
>
> I did some basic tests with PHP 4.3.10 and the implementation seems to be safe:
> - For instance, if you access something like:
> http://<site>/aa/bb/../dd/cc/script.php
> Then SCRIPT_NAME will be "/aa/dd/cc/script.php"
> instead of "/aa/bb/../dd/cc/script.php"
> - If you try:
> http://<site>/aa/bb/cc/script.php/something
> or
> http://<site>/aa/bb/cc/script.php?something
> Then SCRIPT_NAME will contain "/aa/bb/cc/script.php"
>
> My goal is to be able to add some attacker-specified string to the
> variable. Two questions:
> 1) Do you know of any trick/method by which an attacker could alter
> SCRIPT_NAME variable? (obviusly without having access to docroot directory
> and/or edit httpd.conf)
> 2) Perhaps older PHP versions didn't sanitize SCRIPT_NAME variable
> correctly and could be abused? Any idea?
>
> TIA.
>
> Cheers,
> -Román
>
Regards,
Harald Eder
Serg Belokamen wrote::
> Sorry I haven't been following the topic from the very beginning,
> could someone please re-post the original question.
>
> Thank you,
> Serg
>
> On 21 Feb 2006 22:00:18 -0000, contact_at_eder-harald.com
> <contact_at_eder-harald.com> wrote:
>
>> Hi,
>>
>> as far as I know the elements of the $_SERVER array are filled by the webserver and therefore a manipulation through a php trick might by difficult.
>>
>> From my opinion it will be easier to alter this values through a trick on the webserver for instance by using a bug in Apache but I do not know about any which might do this.
>>
>> Anyway, its quite a interesting point of view because many php scripts use the $_SERVER['REMOTE_ADDR'] value for their session management und maybe some other array items too.
>>
>> But it would be also quite interesting if php uses the items of this array to do something or if its just an array with no effect for the php scripts. Does anybody know more about this?
>>
>>
Received on Feb 22 2006
Intro
