Re: security problem in the /fetch/docsauth.php

On Sun Jun 13 08:35:23 2004 Nuno Lopes wrote: > Hi, > > There is a security problem in the new script to authenticate users in our > site. > The problem is that register_globals is on in the master server, so I could > hack the script and login myself :) > > Just do something like: > > http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=**server_ip**&token=**token**&credential=a_magic_cookie > > And you can use the script. > > And the token shouldn't be a md5/sha hash?... I've fixed the missing md5() around $_GET['token']). Also I've tested doing something like http://server.name/phpinfo.php?_SERVER[REMOTE_ADDR]=127.0.0.1&toekn=testing&credentials=testing to see if $_SERVER['REMOTE_ADDR'] changes when register globals is turned on and it does not change, which is correct. Regards --jm > > Nuno