Beside PHP is interpreted, version <= to PHP 5.3.4 are vulnerable to an attack commonly call null byte injection.
To declare a string in php, you use $var = "hey"
which is then equivalent in C to char tab[4]="hey"
. Notice that we declared a 4 bytes array of characters while we only want to store 3 characters. This is because compiler automatically insert the null byte character. Your final string is then hey\0
tab
is a pointer which point on the first character of your string. Your computer will read from the first character to the null byte character (0 in hexadecimal) represented by \0
.
%00
is the representation of the null byte character in PHP.
When you are calling a function with a string, like readfile("pages/$path/index.html");
, your string get stored in a variable. Let's call it $tmp=pages/pathFromVariable/index.html
which in reality will be stored in memory as pages/pathFromVariable/index.html\0
Now, if you inject null byte at the end of your input, you can erase the end of the string. for example, if $tmp=pages/pathFromVariable%00/index.html
it will be stored as pages/pathFromVariable\0/index.html\0
which will result into reading the file pages/pathFromVariable
! Pwned !