search

judge0 / ide

✨ Simple, free and open-source online code editor.
https://ide.judge0.com
MIT License
818 stars 256 forks source link

Bug PHP Code Injection #39

Closed daffainfo closed 4 years ago

daffainfo commented 4 years ago

Hello, i found PHP Code injection image Iam using system() function in PHP to test it, when run simple php code injection payload to read /etc/passwd <?php system('cat /etc/passwd'); ?> The output will be like this image

hermanzdosilovic commented 4 years ago

That is OK, code is run in a sandboxed environment. The same thing can be achieved with Bash.

Thanks for the heads up though and let me know if you found a bug that allowed you to exploit the IDE or API.