2

I read about the EAR vulnerability in websites. But its hard to think of an exploit for EAR in PHP. Can anyone provide a specific example about how the attacker can exploit?

0

2 Answers 2

5

Consider the code below;

<?php

if (!$loggedin) {
  header('location: login.php');
}

echo 'You can only see this secret stuff if you are logged in!';

The echo'ed text is still returned - so not blindly obeying the location header will let you read the "secret message".

Also, I think this post belongs on https://security.stackexchange.com/

2
  • The point here is that header sets an HTTP response header field that is only interpreted by the client.
    – Gumbo
    Commented Mar 4, 2014 at 7:25
  • Thanks for the reply hank. How can I move this post to security.stackexchange.com
    – Siddharth
    Commented Mar 4, 2014 at 7:26
3

If you would have followed one link further to "Fear the Ear" you would have found:

Listing 3: Example of an information leakage Execution After Redirect vulnerability in PHP:

$current_user = get_current_user ();
if (!$current_user ->is_admin())
{
    header("Location: /");
}
echo "Sensitive Information ";
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.