During pentesting, I came across a target vulnerable to local file inclusiong:
include("$rootpath/includes/dir/".$_GET["section"].".php");
When I visit the URL
http://target.com/img?section=images
it works perfectly as images.php
is present in the $rootpath/includes/dir/
directory. When I visit http://target.com/img?section=images.php
I get nothing, indicating that the server could not find any images.php.php
file.
Is there any way to bypass the .php
append restriction? I tried http://target.com/img?section=images.php%00
but the webserver is now trying to find http://target.com/img?section=images.php%00.php
file. I want to read the /etc/passwd
file.
http://target.com/img?section=images.php%0d%0a