Closed GoogleCodeExporter closed 9 years ago
index.php $page = $_GET['page']; // UNFILTERED! Include a PHP file on the server: index.php?page=../somephpfile Read /etc/passwd: index.php?page=../../../../../../../../etc/passwd[POISON NULL BYTE] Fix: $page = basename(str_replace(chr(0), "", $_GET['page']));
Original issue reported on code.google.com by accz....@gmail.com on 10 Oct 2010 at 3:18
accz....@gmail.com
Original comment by apadro...@gmail.com on 15 Oct 2010 at 7:02
apadro...@gmail.com
Original issue reported on code.google.com by
accz....@gmail.com
on 10 Oct 2010 at 3:18