Edit report at https://bugs.php.net/bug.php?id=70405&edit=1
ID: 70405
Updated by: [email protected]
Reported by: incubeftw at gmail dot com
Summary: Exploit
-Status: Open
+Status: Not a bug
-Type: Security
+Type: Bug
Package: PHP Language Specification
Operating System: Ubuntu 15.04
PHP Version: 7.0.0RC1
Block user comment: N
Private report: Y
New Comment:
This is not a bug.
The private and protected keywords are visibility modifiers, meaning they allow you to modify (or not) on certain properties.
Checkout the documentation[1] for var_dump(), it is already explicitly written there that no matter the visibility modifiers are for properties, everything is read. The object to array cast is described here[2].
[1] http://php.net/var_dump
[2] http://php.net/language.types.array#language.types.array.casting
Previous Comments:
------------------------------------------------------------------------
[2015-09-02 09:55:33] incubeftw at gmail dot com
Description:
------------
You can access any variable READ-ONLY on every class by dumping it.
Getting it's value is even easier since you can just cast it to an array and then dump it to file. It does NOT matter if it is a protected variable or not.
Test script:
---------------
<?php
class A {
private $mysqlUser = 'root';
protected $mysqlPassword = 'test';
private $mysqlDatabase = 'myDatabase';
}
$classA = new A();
echo "<pre>";
// Exploit #1
var_dump($classA);
// Exploit #2
foreach((array)$classA as $x => $y) {
echo "X => ".$x." Y => ".$y."\n";
}
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=70405&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.