Liam-Nothing/ExploitMe-Chat

Security Flaws in the Application

This document highlights the potential security vulnerabilities present in the application.

1. Remote Code Execution (RCE)

The application allows the execution of arbitrary PHP code due to improper input handling.

Payload Example:

test\'; var_dump($config); echo \'qsdqsd

---

2. Stored Cross-Site Scripting (XSS)

The application does not sanitize user inputs, allowing malicious scripts to be stored in the database and executed in users' browsers.

Payload Example:

<b>XSS Stored</b>

---

3. File Inclusion Vulnerability

The file upload functionality can be exploited to upload and execute malicious PHP files instead of images.

Exploit:

• Upload a PHP file in place of an image.
• Access the file directly through the uploaded file URL.

---

4. Unauthorized Access

The application lacks proper authentication for critical endpoints, allowing unauthorized users to perform administrative actions.

Example:

• reset_chat.php can be accessed and executed without authentication.

---

5. SQL Injection

The application concatenates user inputs directly into SQL queries, making it vulnerable to SQL injection attacks.

Payload Example:

'); DROP TABLE chats; --

---

Project Setup with Docker

To initialize and run the project using Docker, follow these steps:

1. Build the Docker environment:

   sudo docker-compose build

2. Start the Docker containers:

   sudo docker-compose up -d

3. Stop and remove the Docker containers:

   sudo docker-compose down

---

Difference Between safe and unsafe

The application is divided into two sections: safe and unsafe:

• safe:

  • Implements basic security measures such as input validation and prepared statements to mitigate SQL injection and XSS attacks.
  • Ensures file uploads are validated for allowed MIME types.

• unsafe:

  • Contains intentionally vulnerable code for educational purposes.
  • Allows exploitation of SQL injection, XSS, file inclusion, and other vulnerabilities.

---