[SOLVED] PHP_SELF validation

[xiao]

Hi,

 

I've used the Acunetix scanner to check for vulnerabilities, and it outputs that my

$_SERVER['PHP_SELF']

isn't validated.

I tried to filter it for special characters, but doesn't PHP_SELf always use special characters? (:,/,.)

How do I filter it?

 

Thank you.

[phpSensei]

You don't validate a $_SERVER['PHP_SELF']; var.

 

 

[xiao]

Why does Acunetix report this then?

 

Cross Site Scripting in URI

...

This XSS variant usually appears when a PHP script is using one of following variables without filtering them:

PHP_SELF

REQUEST_URI

SCRIPT_URL

SCRIPT_URI

...

This vulnerability affects /league/matches.php/>"><ScRiPt>alert(1674394882)%3B</ScRiPt>.

[phpSensei]

Why does Acunetix report this then?

 

Cross Site Scripting in URI

...

This XSS variant usually appears when a PHP script is using one of following variables without filtering them:

PHP_SELF

REQUEST_URI

SCRIPT_URL

SCRIPT_URI

...

This vulnerability affects /league/matches.php/>"><ScRiPt>alert(1674394882)%3B</ScRiPt>.

 

That means the URL is vulnerable to XSS.

 

 

use this function strip_tags($URL);

 

 

You should be fine.

[xiao]

so

strip_tags($_SERVER['PHP_SELF'])

?

[phpSensei]

so

strip_tags($_SERVER['PHP_SELF'])

?

 

Okay I will break this down for you.

 

Lets say you have a HTTP VAR (Http://www.site.com/?var=ThisIstVulnerable)

 

Now when you do something like

 

<?php

$url = $_GET['var']; 
$url = strip_tags($url); // Removes any HTML in the URL


?>

 

You use it only when you get data from the URL....

 

 

XSS

 

http://www.cgisecurity.com/articles/xss-faq.shtml

 

[xiao]

ok, thank you

[phpSensei]

ok, thank you

 

I am sorry, I am just not good at giving lessons. Read the article I just posted for you.

 

Your welcome. 

[PFMaBiSmAd]

Unfortunately, $_SERVER['PHP_SELF'] can be used for XSS and it should not be used where it is echoed out to the browser -

 

http://blog.phpdoc.info/archives/13-XSS-Woes.html

 

http://www.mc2design.com/blog/php_self-you-little-rascal

 

http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt

[xiao]

Thank you

basename($_SERVER[’SCRIPT_FILENAME’])

seems to work just fine too