#48231 [Opn->WFx]: create_function() command injection vulnerability

ID: 48231 Updated by: jani@php.net Reported By: root at 80sec dot com -Status: Open +Status: Wont fix Bug Type: Scripting Engine problem Operating System: * PHP Version: 5.*, 6CVS (2009-05-11) New Comment: Yea. Right. And eval() is also very secure when passed unfiltered input.. Previous Comments: ------------------------------------------------------------------------ [2009-05-11 02:53:18] root at 80sec dot com Description: ------------ there is a commond injection in this function,you can EXECUTE your php code directly but not CREATE a lambda-style function.It is very useful when sometimes you can create a function but cann¡¯t call your function. Reproduce code: --------------- <?php $newfunc = create_function('', '};phpinfo();//'); ?> Expected result: ---------------- phpinfo executes runtime,needn't call newfunc. Actual result: -------------- phpinfo executes runtime,needn't call newfunc. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=48231&edit=1