Skip to content
BackEsc
Sign in

External Variable Modification · passage 2 of 6

Methodology

Text · External Variable Modification/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

The `extract()` function in PHP imports variables from an array into the current symbol table. While it may seem convenient, it can introduce serious security risks, especially when handling user-supplied data. * It allows overwriting existing variables. * It can lead to **variable pollution**, impacting security mechanisms. * It can be used as a **gadget** to trigger other vulnerabilities like Remote Code Execution (RCE) and Local File Inclusion (LFI). By default, `extract()` uses `EXTR_OVERWRITE`, meaning it **replaces existing variables** if they share the same name as keys in the input array.

Source: External Variable Modification/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 6 is a mark on the map. Named now: 1 to 6, reading order first.

  1. External Variable Modification§ 1text · README.md
  2. Methodology§ 2text · README.md
  3. Overwriting Critical Variables§ 32 code blocks · README.md
  4. Poisoning File Inclusion§ 42 code blocks · README.md
  5. Global Variable Injection§ 52 code blocks · README.md
  6. Remediations§ 61 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in