Blog -> CyberFinch Designs

Is it possible to do a PHP injection on a PHP page even if there is no form field even on the page?

Yes, it is possible to perform a PHP injection attack on a PHP page even if there are no visible form fields present. As it turns out, there are multiple avenues of user input, and thus possible PHP injection.

How PHP Injection Works

1. PHP injection typically relies on user input being passed to PHP code, regardless of whether it comes from a form field or not [1].
2. Common vectors for PHP injection include:

• Query string parameters (e.g. ?param=value)
• Cookies
• HTTP headers
• Uploaded files
• Environment variables [5]

1. Any user input that is processed by PHP code without proper sanitization can potentially be exploited for injection [1].

Examples of PHP Injection Without Form Fields

1. Exploiting query string parameters:

$unsafeParam = $_GET['param'];
$unsafeQuery = "SELECT * FROM users WHERE username = '$unsafeParam'";

2. Using cookies:

$cookieValue = $_COOKIE['session_id'];
$unsafeQuery = "SELECT * FROM sessions WHERE id = '$cookieValue'";

3. Injecting via HTTP headers:

$headerValue = $_SERVER['HTTP_USER_AGENT'];
$unsafeQuery = "SELECT * FROM devices WHERE agent = '$headerValue'";

4. Exploiting uploaded files:

$fileName = $_FILES['file']['name'];
$unsafeCommand = "mv $fileName /tmp/";
system($unsafeCommand);

Prevention Strategies

1. Always sanitize and validate user input before using it in PHP code [4].
2. Use prepared statements with parameterized queries for database operations [3].
3. Avoid using functions like eval(), exec(), system() etc. unless absolutely necessary [4].
4. Implement proper input filtering using functions like filter_input() [5].
5. Regularly update PHP and related software to patch known vulnerabilities [4].

In summary, while form fields are a common vector for injection attacks, they are not the only possibility. Any user input that reaches PHP code without proper validation can potentially be exploited for injection, even on pages without visible form elements. Therefore, it’s crucial to implement comprehensive input sanitization and security measures across all aspects of PHP applications.

Citations:
[1] https://stackoverflow.com/questions/16048185/no-entry-fields-preclude-the-possibility-of-sql-injections
[2] https://jetpack.com/blog/php-object-injection/
[3] https://www.php.net/manual/en/security.database.sql-injection.php
[4] https://beaglesecurity.com/blog/vulnerability/php-code-injection.html
[5] https://www.stackhawk.com/blog/php-command-injection/
[6] https://brightsec.com/blog/code-injection-example/
[7] https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
[8] http://phpsecurity.readthedocs.io/en/latest/Injection-Attacks.html
[9] https://www.cloudways.com/blog/prevent-php-sql-injection/
[10] https://security.stackexchange.com/questions/269234/this-is-supposed-to-be-vulnerable-to-sql-injection-but-i-cant-really-see-how-i