Waraxe IT Security Portal

Lord_Saigon · Beginner

Hi here.

How can i execute php code stored in a database?

I have a script like this on a webserver :

<?php
$dbConn = mysql_connect("localhost", "user", "pass");
mysql_select_db("db_name", $dbConn);

$sqlQuery = "SELECT * FROM test_table ORDER BY id";
$qResult = mysql_query($sqlQuery, $dbConn);

while( $Stored = mysql_fetch_array($qResult, MYSQL_ASSOC) ){
print($Stored["code"]);
}

?>

The "code" field has been filled with php code like that :

<?php echo("<b>It's a test</b>"); ?>

This code above does make a simple blank page...

My question is : there is an exploit to do something like that?

Thanks

Chb · Valuable expert

You could eval() the stuff (executes PHP-commands at the runtime). Do not ask how, just take a look at the PHP documentation.

Lord_Saigon · Beginner