The PHP code has a
handleRoute($path) function that is triggered for URLs like
server.com/routeme/a. Handle route has the follwing: if
The $path argument is
A Google search leads to a million results where the file name is directly read from a parameter. When instead read from an URL, I can't just say
server.com/routeme/a/../../, as nginx will reply with
400 Bad Request instead of executing the
I have been attempting to find something that PHP will interpret as a Path outside of
routeme/ while nginx does not and thus still lead to the execution of the include.
I was hoping
../) would do it, but nginx still interprets this as a path.
I have a feeling that either I'm missing some obvious method to do this, or that it is a dead end and the code not vulnerable.