Arbitrary Command Execution

PHP

preg_replace()

  • Used in PHP to perform regular expression-based replacements.

    • Syntax: preg_replace(pattern, replacement, subject);

    • If the /e modifier (or PREG_REPLACE_EVAL) is used, the replacement string can be executed as PHP code before the replacement occurs.

Attack Technique

  • While the /e modifier may not be explicitly present in the original code, it can be injected into the regular expression pattern through user input.

  • If user input is used directly in the preg_replace() function, attackers can manipulate requests to inject the /e modifier into the pattern, causing arbitrary PHP code execution.

  • Look for regex patterns on POST requests (/)

  • Some payload examples:

Intercepted POST request
pattern=%2Fx%2Fe&ipaddress=system("id")&text=x
Plain PHP
preg_replace(/x/e, system("id"), x)

PreviousLog PoisoningNextSQLi

Last updated