-4

The code:

eval("\$var = \"".template("show_{$_GET['in']}")."\";");

i tried:

"); phpinfo()

but it doesn't work.
How can I break it to execute arbitrary code into eval ?

closed as off-topic by Alexander O'Mara, forest, Steffen Ullrich, iainpb, Xiong Chiamiov Feb 5 '18 at 17:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – forest, Steffen Ullrich, iainpb
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question is off topic on this site and should be re-posted on Stack Overflow. – dFrancisco Feb 4 '18 at 0:10
  • i asked this in stackoverflow just now, but i think this is related to information security because the subject is about remote code execution. – R00t_R3z Feb 4 '18 at 11:57
2

This is very bizarre construct but it's not the first time someone is using eval for template engine.

It doesn't look to be exploitable from what is shown here because $_GET['in'] is not passed to eval. What is passed to eval() is the result from template().

Maybe there's something inside template which would allow for code execution, but it's not there so there's no way to test it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.