| The Hacker News |
| The Hacker News has been internationally recognized as a leading news source dedicated to promoting awareness for security experts and hackers // via fulltextrssfeed.com |
Web Application Security : PHP SuperGlobal Variables are vulnerable to Hackers
9/9/2013 5:45:00 PM
Hackers are focusing on vulnerabilities in the PHP web application development platform threatening 80% websites in the world, including many big website i.e. Facebook and Wikipedia.
"Because compromised hosts can be used as botnet slaves to attack other servers, exploits against PHP applications can affect the general security and health of the entire web,"
Vulnerability is particularly dangerous due to the common use of PHP and could be used by hackers for a variety of purposes. "The effects of these attacks can be great, as the PHP platform is by far the most popular Web application development platform, powering more than 80% of all Web sites, including Facebook and Wikipedia. Clearly, it is time for the security community to devote more attention to this issue."
By injecting malicious value into an internal variable using PHP's Superglobal mechanism, the attacker is able to change the application flow and execute arbitrary commands to take control over the server.
They note that PHP applications do not protect against the modification of variables from external sources, such as query parameters or cookies.
"Based on the captured malicious traffic, we were able to trace its origin and find the specific exploit code used to generate it in a hacker forum on the web."
Imperva's research team noted an average of 144 attacks per application that contained attack vectors related to SuperGlobal parameters, for the purpose of remote code execution, remote file inclusion and security filter evasion attacks.
Latest Hacking News Updates
Author details
Mohit Kumar aka 'Unix Root' is Founder and Editor-in-chief of 'The Hacker News'. He is a Security Researcher and Analyst, with experience in various aspects of Information Security. Other than this : He is an Internet Activist, Strong supporter of Anonymous & Wikileaks. Follow him @ Twitter | LinkedIn | Google | Email | Facebook Profile
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
0 comments:
Post a Comment