eBay remote code execution

Re:eBay remote code execution by ledneb on Monday December 16, 2013 @08:34AM (#6914576)

I'm pretty sure the error is when they later take the input and eval it, and the author's managed to dodge their filtering rather than execute arbitrary code in the context of an array-to-string cast (which I was lead to believe when reading that post, at least). Otherwise it implies that some permutation of:

$a = '{${phpinfo()}}'; $b = [$a]; $c = "$b";

Will execute phpinfo()... which it won't.

[ Parent | on HN ]

Re:eBay remote code execution by nwh on Monday December 16, 2013 @08:45AM (#6914627)

I'm not quite sure I understand it either, though this does execute phpinfo.

    $variable = "{${phpinfo()}}";
    echo "$variable is fish";

I feel I've missed the point.

[ Parent | on HN ]

Re:eBay remote code execution by foofoobar on Monday December 16, 2013 @08:52AM (#6914646)

This is how it is executed:

    $variable = "{${phpinfo()}}"; // <- Execution happens here
    echo "$variable is fish";

If you pass a "{${phpinfo()}}" via GET, it is not executed. The execution has to happen later - e.g. by eval() or /e.

[ Parent | on HN ]

Re:eBay remote code execution by snapcracker on Monday December 16, 2013 @08:50AM (#6914639)

Haha same here… anyone care to explain?

[ Parent | on HN ]