Test For Checking Magic Quotes Gpc is On

OWASP 2013-A1 OWASP 2017-A1 WASC-13

There are many servers running PHP with magic_quotes_gpc is on . Enabling this makes the server inconsistent and ineffective. Beagle recommends not to enable magic_quotes_gpc. The magic_quotes_gpc escapes ‘(single quotes),”(double quotes), () and NUL with a backslash automatically. This vulnerability makes easier for remote attackers to conduct SQL injection attacks using a custom request. This vulnerability can be fixed by filtering programming/input php scripts to protect the databases and web application.

Example

The following is an example of magic_quotes_gpc

        magic_quotes_gpc = on

    

Impact

The impact include:-

  • SQL injection attack

Mitigation / Precaution

This vulnerability can be fixed by:-

  • Using input filtering methods.
  • Using updated versions of PHP.

Latest Articles