php attacks

[Ardesco]

I was thinking more along the lines of people I have seen doing.

?page=../templates/index2.php

then it just does an include($_GET['page'])

To display a new page from one document. Easily abusable. Thats what I thought was happening in this case.

My point was that even if you make a drop down list to select pages and then use POST you can still abuse the process by tinkering with the page html. Add a new option to the dropdown that links to a remote site and then submit the form via POST. As easily to abuse as your suggestion, and doesn't take much longer to do.

The only way to get round the abuse is to verify what is in $_GET['page'] / $_POST['page'] / $_REQUEST['page'] before you use it in the rest of your code.

[DiscoStu]

I have no idea what any of the above means, but I'm guessing in this case ignorance is bliss.

[NickFitz]

Probably a bit of both. I'm sure you have people rummaging through sites trying to get this working and i'm sure enterprising individuals will have created bots that rummage through sites trying exploits out and reporting back any open sites they find to thier creators.

Indeed. I recently saw Rasmus Lerdorf, the creator of PHP, give a demo of his tool "Scanmus" which can, in a couple of seconds, identify many such possible exploits on a site simply by trying a variety of different techniques known to allow this kind of thing.

He doesn't make this tool freely available - it's used internally at Yahoo, where he now works, but given that it knows some tricks even the bad guys haven't worked out yet, they feel it's best to keep it in-house.

(For some reason he rejected my suggestion to run it against www.mi5.gov.uk - something about wanting to be able to fly home the next day )

[OrangeHopper]

Thanks for your comments gentlemen.

I bit the bullet and downloaded, built and installed mod_security2 for apache. This should give me the flexibility I feel I need.