#18727 [Opn->Bgs]: XSS in I/O Function Output

ID: 18727 Updated by: sander@php.net Reported By: mattmurphy@kc.rr.com -Status: Open +Status: Bogus Bug Type: Output Control Operating System: Win32 PHP Version: 4.2.2 New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php Previous Comments: ------------------------------------------------------------------------ [2002-08-03 15:40:37] mattmurphy@kc.rr.com This applies to any PHP script that opens files based on some kind of user-input inserted into the file name. If the file open fails, PHP returns a warning. In that warning is the file name that was input. If the user-input were to contain a specially crafted piece of data, arbitrary code could be executed: <?php $handle = fopen("C:\\INETPUB\\WWWROOT\\" . $_GET["resource"], "rb"); ?> http://localhost/fopen.php?resource={SCRIPT}alert('xss'){/SCRIPT} Replace "{" with "<" and "}" with ">" and you are ready to go. When you hit the enter key, the browser urlencodes the malicious string, and PHP attempts to open the file, resulting in the vulnerability. Solution fopen() should *not* return the file name in raw form to the browser. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18727&edit=1