Is this code a security issue?

Discussion in 'PHP' started by fpc, Oct 17, 2006.

0
  1. #1
    I have an advertisor who has requested I use php code to include their ad tag, this is the code they have given me;

    <?php
    $SERVER_NAME=$_SERVER['SERVER_NAME'];
    $urlx=$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
    $ref=str_replace(" ",null,$HTTP_USER_AGENT);
    $URL="http://www.etc.com/etc/etc.php?urlx=".$urlx."&site=".$SERVER_NAME."&ref=".$ref;
    $file = @fopen("$URL", "r");
    $r = "";
    do {
    $data = @fread($file, 8192);
    if (strlen($data) == 0) {
    break;
    }
    $r .= $data;
    } while (true);
    fclose ($file);
    echo $r;


    ?>


    Does this look malicous in any way? Can it be used to run remote commands, upload files or download files? I am a bit paranoid, but only because I am a bit clueless ;>

    Any help is appreciated. thanks
     
    fpc, Oct 17, 2006 IP
  2. SoKickIt

    SoKickIt Active Member

    Messages:
    305
    Likes Received:
    30
    Best Answers:
    0
    Trophy Points:
    70
    #2
    It's not a security issue, just a badly written piece of code.
     
    SoKickIt, Oct 17, 2006 IP
  3. fpc

    fpc Member

    Messages:
    40
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    48
    #3
    what about XSS attacks, or inject html, inject javascript, and any other html compatible markup?
     
    fpc, Oct 17, 2006 IP
  4. Jelf

    Jelf Banned

    Messages:
    1,344
    Likes Received:
    44
    Best Answers:
    0
    Trophy Points:
    0
    #4
    no its not well written but it wont hurt you.
     
    Jelf, Oct 17, 2006 IP
  5. kemus

    kemus Guest

    Messages:
    487
    Likes Received:
    19
    Best Answers:
    0
    Trophy Points:
    0
    #5
    All it does is grab whatever's on:

    hppp://www.etc.com/etc/etc.php?urlx=YOURURLHERE&site=YOURSERVERNAMEHERE&ref=THEPERSON'SUSERAGENT

    And display it on your website.

    It cannot execute any php code or anything server-side.
     
    kemus, Oct 17, 2006 IP
  6. wmtips

    wmtips Well-Known Member

    Messages:
    601
    Likes Received:
    70
    Best Answers:
    1
    Trophy Points:
    150
    #6
    This code looks not safe for me. This script cannot hurt your server, but this script can load anything into your visitor's browser: an arbitrary html or javascript code (for example javascript rotating hidden adsense ads, or making AJAX requests somewere, or making javascript redirect etc.).

    So check the code it outputs, it is not clear without real example.
     
    wmtips, Oct 17, 2006 IP
  7. streety

    streety Peon

    Messages:
    321
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    0
    #7
    All possible, in fact the whole point of the code is to inject html into your pages as that is how the ads will be displayed.

    You have to decide whether you trust the advertiser, in theory google could probably redirect your visitors if they modified the javascript file they use to serve the adsense adverts but we trust them not to do it.

    As wmtips suggests I would look at the code it includes in your files to make sure nothing malicious is going on but they can change it at any time they choose so you have to trust them not to do it.
     
    streety, Oct 17, 2006 IP