0

The following function is used to protect from arbitrary file download:-

function file_download($file_name, $file_path) {
    $allowedExtensions = array(
            "csv"
            );
    $checkFileName = explode(DIRECTORY_SEPARATOR,$file_name);
    $extension = explode(".",$file_name);
    end($extension);
    if (file_exists($file_path) && count($checkFileName) == 1 && in_array(strtolower($extension[key($extension)]),$allowedExtensions)) {
            readfile($file_path);
            exit ;
    }
    return FALSE;
}

Please help bypass the usage is like follows:-

file_download($_GET['file_name'], "path".$_GET['file_name']);
2
  • 2
    Is this for a CTF or homework? Because the code doesn't make much sense; $file_name isn't actually used.
    – tim
    Commented Sep 13, 2017 at 20:23
  • It's a production code.
    – Aayush
    Commented Sep 14, 2017 at 6:27

1 Answer 1

1

You would simply set $file_name to passwd.csv and file_path to /etc/passwd.

1
  • actually, I had posted with an error the question above is edited. Please have a look.
    – Aayush
    Commented Sep 14, 2017 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .