4

After i knew how to secure upload image Bypassing forms input fields to upload unwanted files i would like to give another example of from with 2 filed, one of them are hidden.

SQL Table (id,name,jod,number)

CREATE TABLE `users` (
  `id` bigint(20) unsigned NOT NULL auto_increment,
  `name` varchar(255) default '0',
  `job` varchar(255) default NULL,
  `number` varchar(255) default NULL
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

Form Code (support member will edit own informations)

<form action="send.php" method="post" name="send" id="send">
 <input type="text" name="name" id="name" value="John"/>
 <input type="text" name="job" id="job" value="Plumber"/>
 <input type=hidden name="number" id="number" value="1234"/>
 <input type="Submit" name="Submit" value="Submit"/>
</form>

Later there was an firefox extension that can bypassing different input to the server-side bypassing checking and might case a lot of damage so here it can stop the whole process and makes you able to edit the value of hidden table number to any such as value="1" causing update information for member have that value number 1.

enter image description here

That extension is working as following, It can fake input data before it passed to server side.

enter image description here

PHP Code Send.php

if(isset($_POST['send'])){  

$name   = mysql_real_escape_string($_POST[name]);
$job    = mysql_real_escape_string($_POST[job]);
$number = mysql_real_escape_string($_POST[number]);

$sql= "update users SET name='$name',job='$job' WHERE number='$number'";
       mysql_query($sql) or die("query failed: $sql".mysql_error());

echo "Update Done";

} else { 
echo "Nothing to update";
}

The question How then to protect this simple form from such input form ? ~ Thanks

this problems really hurts cause it made my website free to be hacked :)

Community
  • 1
  • 1
Reham Fahmy
  • 4,937
  • 15
  • 50
  • 71
  • 1
    Instead of binding them with a number, use a UNIQUE id, like PHP's SESSION ID? – hjpotter92 Feb 02 '13 at 13:26
  • 1
    You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) and should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). – Quentin Feb 02 '13 at 13:29

4 Answers4

2

If the user authorization is not an option in your cause, you could try the following techniques:

  • Set the hidden field with a hash of the number salted with some other information
  • Set the hidden field with the number encrypted (possible salt could increase security here also)

Of course it would add extra steps when sending the form HTML and validating the post information, but at least it would be much harder to the attacker fake a valid number on the post. Although it would not save you if the attacker knows the encrypted/hashed number of a different user unless the salted information withing the hidden field is used wisely.

Mateus Schneiders
  • 4,853
  • 3
  • 20
  • 40
1

You can't control what data people submit to your server.

You have to check, on the server, to see if the user is authorised to see the information or to make the change they are asking for.

For example:

able to edit the value of hidden table number to any such as value="1" causing update information for member have that value number 1.

The process would be something like:

  1. Is anybody allowed to edit this field? If so, then OK.
  2. Is the request coming from an authenticated user? If not, then return an error message and a login form
  3. Is the request coming from the user with id=1? If so, then OK
  4. If the request coming from a user who has admin permissions? If so, then OK
  5. Return an error message.
Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335
1

If you have a form and any users to edit the values, this problem is going to be there. A better approach is to authenticate the users. Allow only the users who have logged in with an account to make the changes to their respective accounts.

Also, don't use mysql_query or anything like mysql_*, they are insecure and depreciated in php5.

Sudip Kafle
  • 4,286
  • 5
  • 36
  • 49
0

A hidden field cannot be secured. It's 100% impossible to prevent malicious people from editing it.

The best you can possibly do is validate its data.

For the example field, the best you can do is make sure it's actually a number.

But that doesn't help any.

What you need to do is have the OLD data sent as hidden data. ALL of it. Complete with the old id.

Then you validate both the old and new data. Make sure there's no injected sql code in them. Having done this you would have

$name
$job
$id
$old_name
$old_job

all set. Then you can.

select * from users where name="$old_name" and job="$old_job

if you get back a row, then you can update users set name="$name", job="$job$" where id=$id

Now, even if the user changes the ID, it won't do a thing, because the select will return 0 rows, ad the edit attempt will abort.

Now if someone happens to know all three fields for someone else's entry, they can still change it. The only way around that is force authentication, and have another database tying username/password pairs to IDs.

Mr. Beeblebrox
  • 186
  • 1
  • 5