I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution.
The executed command would be
$(id), but if I execute any other command like
ls -la the space is automatically replaced with
-. I checked the source as well and I found that in addition to spaces, the following chars are filtered:
How can I bypass the filter and execute a command like