1 of 3

It is possible to modify a path directory through the URL parameters?

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is to access to a file named passwords.txt located in \files\private\admin\passwords.txt when I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access to the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want to access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally access to the private directory?