Test For Checking Magic Quotes Gpc is On

Prathap

Published on

02 Jul 2018

Vulnerability

There are many servers running PHP with magic_quotes_gpc is on . Enabling this makes the server inconsistent and ineffective. Beagle recommends not to enable magic_quotes_gpc. The magic_quotes_gpc escapes ‘(single quotes),”(double quotes), () and NUL with a backslash automatically. This vulnerability makes easier for remote attackers to conduct SQL injection attacks using a custom request. This vulnerability can be fixed by filtering programming/input php scripts to protect the databases and web application.

Example

The following is an example of magic_quotes_gpc

        magic_quotes_gpc = on

    

Impact

The impact include:-

SQL injection attack

Mitigation / Precaution

This vulnerability can be fixed by:-

Using input filtering methods.
Using updated versions of PHP.

Automated human-like penetration testing for your web apps & APIs

Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Product tour

Written by