#18727 [Bgs->Opn]: XSS in I/O Function Output

ID: 18727 User updated by: mattmurphy@kc.rr.com Reported By: mattmurphy@kc.rr.com -Status: Bogus +Status: Open Bug Type: Output Control Operating System: Win32 PHP Version: 4.2.2 New Comment: Once again, I'm astounded by the overwhelmingly negative message that the PHP Group sends users of PHP sites -- thanks to us, somebody can steal your personal information! Oh, and, thanks for your business. That is at least counter-productive, yes? Previous Comments: ------------------------------------------------------------------------ [2002-08-03 16:00:54] sander@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ [2002-08-03 15:40:37] mattmurphy@kc.rr.com This applies to any PHP script that opens files based on some kind of user-input inserted into the file name. If the file open fails, PHP returns a warning. In that warning is the file name that was input. If the user-input were to contain a specially crafted piece of data, arbitrary code could be executed: <?php $handle = fopen("C:\\INETPUB\\WWWROOT\\" . $_GET["resource"], "rb"); ?> http://localhost/fopen.php?resource={SCRIPT}alert('xss'){/SCRIPT} Replace "{" with "<" and "}" with ">" and you are ready to go. When you hit the enter key, the browser urlencodes the malicious string, and PHP attempts to open the file, resulting in the vulnerability. Solution fopen() should *not* return the file name in raw form to the browser. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18727&edit=1