I'm assessing security of a webportal for a client and I found a vulnerability.
This is the PHP code:
I was able to successfully read ../../../index.php, config.php etc.
But I just want to be able to prove that this bug is more critical than reading configs. I read the MySQL user/pass, but I can't connect to it since its listening on localhost only. All other codes I read, didn't lead to anything. So basically all I got was just some source code which was kinda no secret.
I can't do php filter stuff because it has "template/data/" in the beginning of string.
What else can be done with this vulnerable piece of code? Any ideas?