0

Let's say I can control the variable $path and the full path is generated as follows:

$full_path = "./valid_dir/docs/" . trim($path) ;
readfile($full_path) ;

where docs a non existent dir in the path.

Is it still possible ,with some trick perhaps to ignore docs, to perform a path traversal attack ?

1

Is it still possible ,with some trick perhaps to ignore docs, to perform a path traversal attack ?

Yes, it's pretty simple, just use ../ and it will be normalized before the file is opened (on *nix systems anyway, I don't know for sure on Windows).

Something like this would work.

$path = '../test.txt';
$full_path = "./valid_dir/docs/" . trim($path);
readfile($full_path);
| improve this answer | |
  • Thanks for the answer. I've found the issue. I tried to put the case as simplified as possible and omited an if with file_exists(). readfile() does normalize but file_exists() does not :s – user68965 Jun 1 '16 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy