Hackers are focusing on vulnerabilities in the PHP web application development platform threatening 80% websites in the world, including many big website i.e. Facebook and Wikipedia. PHP has several predefined variables that are called SuperGlobals i.e. POST, GET, COOKIES, FILES etc.
Imperva Releases Hacker Intelligence Initiative Report, particularly concerned about two vulnerabilities that can be used to execute code on servers running PHP and fail to stop PHP SuperGlobal parameter variables being modified by external sources.
- Dubbed as CVE-2011-2505, describes a vulnerability in the authentication feature in PhpMyAdmin (PMA) that enables attackers to modify the _SESSION SuperGlobal variable.
- CVE-2010-3065 describes a problem in the PHP's session serialization mechanism. By injecting malicious value into an internal variable using PHP's Superglobal mechanism, the attacker is able to change the application flow and execute arbitrary commands to take control over the server.
"Because compromised hosts can be used as botnet slaves to attack other servers, exploits against PHP applications can affect the general security and health of the entire web,"
Vulnerability is particularly dangerous due to the common use of PHP and could be used by hackers for a variety of purposes. "The effects of these attacks can be great, as the PHP platform is by far the most popular Web application development platform, powering more than 80% of all Web sites, including Facebook and Wikipedia. Clearly, it is time for the security community to devote more attention to this issue."
They note that PHP applications do not protect against the modification of variables from external sources, such as query parameters or cookies.
The attacker can combine the two separate vulnerabilities to extend the scope of the flaws. "Based on the captured malicious traffic, we were able to trace its origin and find the specific exploit code used to generate it in a hacker forum on the web."
Imperva's research team noted an average of 144 attacks per application that contained attack vectors related to SuperGlobal parameters, for the purpose of remote code execution, remote file inclusion and security filter evasion attacks.
