PHP代码注入。我们有安全风险吗？
我们有一个简单的 php 文件来捕获电子邮件。它将这些电子邮件放入 csv 文件（该文件不能由 php 执行）。最近有人成功入侵了我们的网站，这似乎是入口点之一，但我不明白这是怎么可能的。这是脚本：
$fh = fopen('cap.csv', 'a+');
fwrite($fh, "\r".$_GET['email']);
fclose($fh);
非常基本，对吧？你能想到利用这个吗？
We have a simple php file that captures emails. It drops these emails into a csv file (which is not executable by php). We recently had someone who managed to hack our site and this seemed like one of the entry points, but I don't see how it's possible. Here's the script:
$fh = fopen('cap.csv', 'a+');
fwrite($fh, "\r".$_GET['email']);
fclose($fh);
Pretty basic right? Is there anyway you can think of to exploit this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
是的，但可能不是您正在寻找的。
我唯一能做的就是：
它不允许我执行任何操作，或访问任何内容。 （除非你处理它并在其他地方造成泄漏）。但仍然要确保安全！
Yes, but probably not what you are looking for.
The only things I could do are:
It won't allow me to execute anything, or gain access to anything though. (Unless you process it and cause an leak somewhere else). But still - make this secure!
您向我们展示的代码只能用于将任何内容放入 csv 文件中（我假设您没有验证/验证
$_GET['email']变量），但您不能以这种方式注入并执行 PHP 代码。也许您有一个可以处理被利用的 csv 文件的脚本。
The code you have shown us can only be used to put anything in the csv file (I assume you don't verify/validate the
$_GET['email']variable), but you can't inject and execute PHP code that way.Maybe you have a script that works on the csv file which got exploited.
对于给定的代码，我现在唯一能想到的是 NullByte 攻击向量（尽管我不确定它们是否适用于当前版本的 PHP 或什至适用于您的代码）。由于您使用的是 $_GET，因此通过电子邮件参数进行的任何攻击都应该在服务器的日志文件中可见。
检查您的日志文件中是否有任何可疑的电子邮件字符串，例如类似
的内容。
The only thing I can think of right now for the given code is a NullByte attack vector (though I'm not sure they work in current versions of PHP anymore or even apply to your code). Since you are using $_GET, any attack via the eMail param should be visible in your server's log files.
Check your Log files for any suspicious email strings, e.g. something like
and similar things.
您发布的代码表明您没有对输入数据进行太多清理。因此，您可能在软件的其他部分也遇到类似的问题。
除此之外，即使您不在应用程序中执行 csv 文件，也可以在其中注入 PHP 代码。
因此，如果应用程序中存在另一个漏洞，无法正确检查输入数据，并且可能会被利用来包含服务器上的文件，然后包含有问题的 csv 文件，则可以执行远程代码。
The code you posted suggests that you do not much sanitization on the input data. So it's likely that you have similar issues in other parts of the software.
Next to that even if you don't execute the csv file within your application, it is possible to inject PHP code therein.
So if there is another hole in the application that does not properly check input data and that could be exploited to include files on the server and then include that csv file in question, remote code execution is possible.