On second inspection, there may be an issue if you have register globals
enabled... this is because of this code:
<? echo base64_decode($url); ?>
If you have register_globals enabled on your web-server, then an attacker
could put data into the $url variable via the URL, which is bad... In order
to fix it, I recommend sanitizing the $url var before you use it (maybe even
after you've decoded it), then once you've sanatized the input, embed it
into the href attribute of the <a> tag.
HTH
"Aidan" <nospam.aidan@linknet.com.au> wrote in message
news:newscache$79baai$bnc$1@titan.linknet.com.au.. .[color=blue]
> No securtiy issues that I can see (though I wouldn't take my word alone),
> as it doesn't take any input from the user apart from clicking the link,
> which is not handled by PHP anyway...
>
> HTH
>
> <jasonbrown1999@yahoo.co.uk> wrote in message
> news:1105662298.516750.230480@z14g2000cwz.googlegr oups.com...[color=green]
>> Someone told me the following script could be used to run harmful
>> commands on the server, by passing commands into the script. What the
>> script does is encode an affiliate URL, create two frames, with the
>> affiliate URL decoded and placed in the bottom URL. The top frame
>> contains
http://www.domain.com/selectanothercard.html for navigation
>> back to the originating site.
>>
>> The script is accessed with a link like this:
>>
>> <a href="sendcard.php?url=<? echo
>> base64_encode("http://affiliateurl.com/ecards/fourthjuly11107/index.php?en=1&aid=12345");
>> ?>" target=_top>Send Card</a>
>>
>> The affiliate URL is first encoded, because otherwise it breaks (the
>> ampersands cause problems). I tried another frame re-directing script,
>> but it wouldn't carry through the affiliate info properly, so someone
>> created this php script to encode/decode and create the frames.
>>
>> Could this script be used to send harmful commands to the server? If
>> so, is there any way of modifying the script to fix that? Perhaps there
>> are other alternatives to passing an affiliate URL into a frame like
>> this script does?
>>
>> Jason
>>
>> <html>
>> <head>
>> <title></title>
>> <meta http-equiv="Content-Type" content="text/html;
>> charset=iso-8859-1">
>> </head>
>> <frameset rows="50,*" cols="*" framespacing="0" frameborder="NO"
>> border="0">
>> <frame src="http://www.domain.com/selectanothercard.html"
>> name="topFrame" scrolling="NO" noresize >
>> <frame src="<? echo base64_decode($url); ?>" name="mainFrame">
>> </frameset>
>> <noframes>
>> <body>
>> Your browser does not support frames.
>> </body>
>> </noframes>
>> </html>
>>
>> <?
>> //////////////////////////////////////////////////////////////////////////////
>> // NOTES
>> //////////////////////////////////////////////////////////////////////////////
>> /*
>>
>> HOW TO LINK TO THIS FRAMESET
>> ----------------------------
>>
>> * Your document that contains the links, must have the file extension
>> .php
>>
>> EXAMPLE LINK:
>>
>> <a href="sendcard.php?url=<? echo
>> base64_encode("http://affiliateurl.com/ecards/fourthjuly11107/index.php?en=1&aid=12345");
>> ?>" target=_top>Send Card</a>
>>
>> */
>>
>> //////////////////////////////////////////////////////////////////////////////
>> // END NOTES
>> //////////////////////////////////////////////////////////////////////////////
>> ?>
>>[/color]
>
>[/color]
