External Variable Modification

> External Variable Modification Vulnerability occurs when a web application improperly handles user input, allowing attackers to overwrite internal variables. In PHP, functions like extract($_GET), extract($_POST), or import_request_variables() can be abused if they import user-controlled data into the global scope without proper validation. This can lead to security issues such as unauthorized changes to application logic, privilege escalation, or bypassing security controls.

The `extract()` function in PHP imports variables from an array into the current symbol table. While it may seem convenient, it can introduce serious security risks, especially when handling user-supplied data. * It allows overwriting existing variables. * It can lead to **variable pollution**, impacting security mechanisms. * It can be used as a **gadget** to trigger other vulnerabilities like Remote Code Execution (RCE) and Local File Inclusion (LFI). By default, `extract()` uses `EXTR_OVERWRITE`, meaning it **replaces existing variables** if they share the same name as keys in the input array.

If `extract()` is used in a script that relies on specific variables, an attacker can manipulate them.

<?php
    $authenticated = false;
    extract($_GET);
    if ($authenticated) {
        echo "Access granted!";
    } else {
        echo "Access denied!";
    }
?>

**Exploitation:** In this example, the use of `extract($_GET)` allow an attacker to set the `$authenticated` variable to `true`:

http://example.com/vuln.php?authenticated=true
http://example.com/vuln.php?authenticated=1

If `extract()` is combined with file inclusion, attackers can control file paths.

<?php
    $page = "config.php";
    extract($_GET);
    include "$page";
?>

**Exploitation:**

http://example.com/vuln.php?page=../../etc/passwd

:warning: As of PHP 8.1.0, write access to the entire `$GLOBALS` array is no longer supported. Overwriting `$GLOBALS` when an application calls `extract` function on untrusted value:

extract($_GET);

An attacker can manipulate **global variables**:

http://example.com/vuln.php?GLOBALS[admin]=1

Use `EXTR_SKIP` to prevent overwriting:

extract($_GET, EXTR_SKIP);