Re: Error behaviour for max_input_vars
| From: | Craig Francis | Date: | Sat, 17 Sep 2022 11:14:48 +0000 |
| Subject: | Re: Error behaviour for max_input_vars | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-118647@lists.php.net to get a copy of this message | ||
On 14 Sep 2022, at 20:55, Tim Düsterhus <tim@bastelstu.be> wrote:
> As indicated by the phrasing in my previous email, this knowledge does not enable an attacker
> to do anything that they wouldn't be able to do otherwise.
One possibility... when you say the attacker is able to "not send all the fields", would
that be via injecting malicious JavaScript? which would hopefully be blocked via the websites
Content Security Policy?... a different approach could use a simple XSS within the <form>, and
injecting ~995 hidden <input> fields:
```
<form action="/user/edit" method="post">
[...]
<input type="hidden" name="xss[]" />
<input type="hidden" name="xss[]" />
<input type="hidden" name="xss[]" />
[...]
<label>
<input type="checkbox" name="group_delete[]" value="1" />
Remove from Group 1
</label>
[...]
</form>
```
Craig