Greetings All,
I am trying to reproduce the issue, but php is reporting some error:
like fail to open lang/../../../../../../../../../../etc/passwd%00; path=//lang.php.
vulnerable code is:
include("lang/".$_SESSION['language']."/lang.php");
exploit is: ../../../../../../../../../../etc/passwd%00; path=/ as the value of vulnerable paramter.
exploit link is:http://milw0rm.com/exploits/6641
After observing this error i thought there must some issue with the application, so created a vulnerable php program whose details are:
<?php
include("lang/".$_GET[filename]."/lang.php");
?>
Then i send a GET a request:
GET /vulnerable php?filename=lang/../../../../../../../../../../etc/passwd%00; path=/
still, i am observing same error.
This is happening because inside include function, there is an additon of /lang.php after the vulnerable parameter value in both case.
I am not able to understand how the author manage to view the contents of /etc/passwd by this method.
please help me out.
Thanks in advance.
