For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running on localhost), we came to the conclusion that the only possible place to inject anything is following code snippet:
if (!file_exists($filepath . $file . '.php')) {
redirect_main_page();
}
include_once($filepath . $file . '.php');
However, we have further constraints ini_set("include_path", ".:../etc/:../files/");
So is there any way to exploit the include? The ultimate goal is to display the /var/www/html/project/etc/config.php on the website.
What we have tried so far:
->Fatal Error: include_once(): Failed opening '/var/www/html/project/files/../etc/config.php' for inclusion (include_path='.:../etc/:../pages/') (2).