0

The following function is used to protect from arbitrary file download:-

function file_download($file_name, $file_path) {
    $allowedExtensions = array(
            "csv"
            );
    $checkFileName = explode(DIRECTORY_SEPARATOR,$file_name);
    $extension = explode(".",$file_name);
    end($extension);
    if (file_exists($file_path) && count($checkFileName) == 1 && in_array(strtolower($extension[key($extension)]),$allowedExtensions)) {
            readfile($file_path);
            exit ;
    }
    return FALSE;
}

Please help bypass the usage is like follows:-

file_download($_GET['file_name'], "path".$_GET['file_name']);
2
  • 2
    Is this for a CTF or homework? Because the code doesn't make much sense; $file_name isn't actually used.
    – tim
    Sep 13, 2017 at 20:23
  • It's a production code.
    – Aayush
    Sep 14, 2017 at 6:27

1 Answer 1

1

You would simply set $file_name to passwd.csv and file_path to /etc/passwd.

1
  • actually, I had posted with an error the question above is edited. Please have a look.
    – Aayush
    Sep 14, 2017 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.