LDAP Injection (ARCH7107)

Key php.security.ldap-injection · Severity error · Category security · CWE CWE-90

Concatenating LDAP search filters with unescaped user input lets an attacker alter the filter and, for example, inject * to bypass authentication.

Incorrect

<?php
$user = $_POST['user'];
$filter = "(uid=$user)"; // (uid=*) bypasses the filter
$result = ldap_search($conn, $baseDn, $filter);

Correct

<?php
$user = ldap_escape($_POST['user'], '', LDAP_ESCAPE_FILTER);
$filter = "(uid=$user)";
$result = ldap_search($conn, $baseDn, $filter);

Fix

Escape all input that enters a filter with ldap_escape($value, '', LDAP_ESCAPE_FILTER).