Re: PHP parse_str() arbitrary variable overwrite
Nice find, although it's not really clear to me whether this is
intended functionality or not. I assume it's not intended by
Hardened-PHP and Suhosin, at least :)
You didn't mention this, but even if register_globals is disabled,
this seems to work, at least in my PHP 4.4.4.
Try the code below with:
?var=new
--> generates an error (display_errors=1) that var2 is undefined
?var2=new
--> prints "var2 = new"
<?php
$var = 'init'; #
parse_str($_SERVER['QUERY_STRING']); #
print "var = $var<p>\n"; # new
print "var2 = $var2<p>\n"; # new
?>
- Steve
討論串 (同標題文章)
完整討論串 (本文為第 3 之 5 篇)：