I read about the EAR vulnerability in websites. But its hard to think of an exploit for EAR in PHP. Can anyone provide a specific example about how the attacker can exploit?
2 Answers
Consider the code below;
<?php
if (!$loggedin) {
header('location: login.php');
}
echo 'You can only see this secret stuff if you are logged in!';
The echo'ed text is still returned - so not blindly obeying the location header will let you read the "secret message".
Also, I think this post belongs on https://security.stackexchange.com/
-
The point here is that
headersets an HTTP response header field that is only interpreted by the client.– GumboCommented Mar 4, 2014 at 7:25 -
Thanks for the reply hank. How can I move this post to security.stackexchange.com Commented Mar 4, 2014 at 7:26
If you would have followed one link further to "Fear the Ear" you would have found:
Listing 3: Example of an information leakage Execution After Redirect vulnerability in PHP:
$current_user = get_current_user ();
if (!$current_user ->is_admin())
{
header("Location: /");
}
echo "Sensitive Information ";