Code Evaluation (PHP) - Vulnerability Database

Code Evaluation (PHP)

Description

This application is vulnerable to PHP code injection, a critical security flaw that allows attackers to execute arbitrary PHP code on the server. This vulnerability occurs when user-controlled input is passed directly to dangerous functions like eval(), assert(), or similar dynamic code execution functions without proper validation or sanitization. When exploited, attackers can inject malicious PHP code that will be executed with the same privileges as the web application.

Remediation

Eliminate the use of dynamic code evaluation functions entirely. Follow these remediation steps:

1. Remove dangerous functions: Avoid using eval(), assert(), create_function(), and similar functions that execute arbitrary code. Refactor code to use safer alternatives.

2. Use safe alternatives: Replace dynamic evaluation with predefined logic, switch statements, or lookup arrays:

// VULNERABLE CODE:
$operation = $_GET['op'];
eval('$result = ' . $operation . ';');

// SECURE ALTERNATIVE:
$allowed_operations = [
  'add' => function($a, $b) { return $a + $b; },
  'subtract' => function($a, $b) { return $a - $b; }
];

$operation = $_GET['op'];
if (isset($allowed_operations[$operation])) {
  $result = $allowed_operations[$operation]($a, $b);
}

3. Input validation: If dynamic behavior is absolutely necessary, implement strict allowlisting of permitted values and reject any input that doesn't match expected patterns.

4. Disable dangerous functions: Add eval, assert, create_function to the disable_functions directive in php.ini as a defense-in-depth measure.