$a = '{${phpinfo()}}'; $b = [$a]; $c = "$b";
Will execute phpinfo()... which it won't.
$variable = "{${phpinfo()}}";
echo "$variable is fish";
$variable = "{${phpinfo()}}"; // <- Execution happens here
echo "$variable is fish";
This phrase "internally php strings are byte arrays. As a result accessing or modifying a string using array brackets will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met." doesn't seem to be present in the linked documentation (http://www.php.net/manual/en/language.types.string.php), however. Does anyone know what these "prior mentioned requirements" might be?
Internally, PHP strings are byte arrays. As a result, accessing or modifying a string using array brackets is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
It seems like they just replaced:
is not multi-byte safe, and should only be done with strings that are in a single-byte encoding such as ISO-8859-1.
...with...
will trick the parser into evaluating arbitrary php code in the scope of the variable if the prior mentioned requirements are met.
It's still not an explanation of how you go from injecting a deformed string to executing code.
Presumably the bounty was distributed without incident which is worth noting the recent threads of bounties being forfeited.
I wonder if doing "$cast = (string) $input" prior to the rest will avoid it? I do things like that, as well as making sure all methods use type hinting, which would hopefully make this harder?
Learned something though.