Hackers are focusing on vulnerabilities in the PHP web application development platform threatening 80% websites in the world, including many big website i.e. Facebook and Wikipedia.
Imperva Releases Hacker Intelligence Initiative Report, particularly concerned about two vulnerabilities that can be used to execute code on servers running PHP and fail to stop PHP SuperGlobal parameter variables being modified by external sources.
“Because compromised hosts can be used as botnet slaves to attack other servers, exploits against PHP applications can affect the general security and health of the entire web,”
Vulnerability is particularly dangerous due to the common use of PHP and could be used by hackers for a variety of purposes. “The effects of these attacks can be great, as the PHP platform is by far the most popular Web application development platform, powering more than 80% of all Web sites, including Facebook and Wikipedia. Clearly, it is time for the security community to devote more attention to this issue.“
By injecting malicious value into an internal variable using PHP’s Superglobal mechanism, the attacker is able to change the application flow and execute arbitrary commands to take control over the server.
They note that PHP applications do not protect against the modification of variables from external sources, such as query parameters or cookies.
“Based on the captured malicious traffic, we were able to trace its origin and find the specific exploit code used to generate it in a hacker forum on the web.”
Imperva’s research team noted an average of 144 attacks per application that contained attack vectors related to SuperGlobal parameters, for the purpose of remote code execution, remote file inclusion and security filter evasion attacks.