BUG REPORT: Command Injection in Online Compiler

[priyanshukumar397]

Summary:

Online IDE allows insecure code execution for php language which allows any attacker to gain system information such as - users information, files present in the directory and much more.

Affected Domain:

https://onecompiler.com/php/42zact3d8

Severity:

High

Steps to reproduce:

1. Go to - https://onecompiler.com/php/42zact3d8
2. Enter the given code below and execute it.

Impact:

Allowed to use vulnerable functions and code execution in online ide for php programming language. As an attacker, users and systems information were given out by the use of code execution!!

PoC:

Output:


HelloWorld.php

root
root<br />
daemon<br />
bin<br />
sys<br />
sync<br />
games<br />
man<br />
lp<br />
mail<br />
news<br />
uucp<br />
proxy<br />
www-data<br />
backup<br />
list<br />
irc<br />
_apt<br />
nobody<br />
ubuntu<br />
systemd-network<br />
systemd-timesync<br />
messagebus<br />
systemd-resolve<br />
polkitd<br />
coderunner<br />
coderunnerw<br />
coderunnerwi<br />

coderunner<br />




8.3.6
root:x:0:0:root:/root:/bin/bash<br />
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin<br />
bin:x:2:2:bin:/bin:/usr/sbin/nologin<br />
sys:x:3:3:sys:/dev:/usr/sbin/nologin<br />
sync:x:4:65534:sync:/bin:/bin/sync<br />
games:x:5:60:games:/usr/games:/usr/sbin/nologin<br />
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin<br />
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin<br />
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin<br />
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin<br />
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin<br />
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin<br />
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin<br />
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin<br />
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin<br />
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin<br />
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin<br />
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin<br />
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash<br />
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin<br />
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin<br />
messagebus:x:100:101::/nonexistent:/usr/sbin/nologin<br />
systemd-resolve:x:996:996:systemd Resolver:/:/usr/sbin/nologin<br />
polkitd:x:995:995:User for polkitd:/:/usr/sbin/nologin<br />
coderunner:x:2345:2345::/coderunner:/bin/sh<br />
coderunnerw:x:2346:2346::/coderunner:/bin/sh<br />
coderunnerwi:x:2347:2347::/coderunner:/bin/sh<br />
SELECT * FROM users WHERE username =  OR 1=1 --<br />
<script>alert('XSS');</script>Output:

Fix:

Block the usage of such code exceptions code - sanitize user inputs

[priyanshukumar397]

kindly check and revert back
@onecompiler-ops