Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: "Christoph M. Becker" Newsgroups: comp.lang.php Subject: Re: php challenge Date: Thu, 27 Nov 2014 19:52:30 +0100 Organization: solani.org Lines: 16 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Trace: solani.org 1417114341 28750 eJwFwYEBwCAIA7CXrJSC5zCR/09Y4iboBuWij08z1pjB9sJxZDP5Tje/srrjxOaNipcCUvoBBbIQQQ== (27 Nov 2014 18:52:21 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Thu, 27 Nov 2014 18:52:21 +0000 (UTC) User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 X-User-ID: eJwNwokRwDAIA7CV+GzIOgSy/wjtSXAqbwbBwPsdbkcVJx1TT1b14ohnS/uaDMsaBmOUWH8KLhAT In-Reply-To: Cancel-Lock: sha1:YeSzNTjOE2NYABkqzFosNFWMtgI= X-NNTP-Posting-Host: eJwNxEkBACAIBMBKIixHHEHoH0HnMWAlLROFCgbjwtm2/DRutEEJi81PGPIKflG7aggRTpQPEfIQuQ== Xref: csiph.com comp.lang.php:14650 Kiuhnm Mnhuik wrote: > Here's the picture of the challenge "other2" found on > http://halls-of-valhalla.org/: http://i.share.pho.to/fd1e7ff4_o.png > AFAIK, we can only control $_GET['username'] and $_GET['password']. > Since there aren't any evals or similar I don't see how we can inject > code. I suspect we have to set $loggedIn to true, but how? If register_globals[1]=On that would be easy (because $loggedIn is not necessarily initialized, and it is tested for being == true, instead of === true). Fortunately, that misfeature had been removed as of PHP 5.4. [1] -- Christoph M. Becker