<html>
<body>
<?php
$username = $_POST['username'];
$password = $_POST['password'];
$name = $_POST['name'];
echo "Doing ``"."useradd $username -p '$password' "."'' as ".get_current_user()."..<br/>";
passthru("/usr/bin/sudo /usr/bin/sbin/useradd $username -p '$password'" );
echo "finished ok<br>";
?>
<p>
<a href="index.html">Go back and try again</a>
</body>
</html>
Tell me more
×
Code Review Stack Exchange is a question and answer site for
peer programmer code reviews. It's 100% free, no registration required.
|
|
|||
|
I strongly suggest to sanitize the input ($_POST[]) before using. Even more in your case that you execute shell command with it. |
|||
|
|
|
I can exploit that in a few moments: Set username to "; newcommand here to pwn your box" or " || other command" YOU NEED to sanitize the values prior to running this. Using strpos and check for possible exploits. |
|||
|
|
$return_varparameter to see what sudo returns to you. – Quentin Pradet Mar 2 '12 at 20:36