Re: Defining PHP varibles from URL
| From: | Miguel Cruz | Date: | Sun, 05 May 2002 15:09:02 +0000 |
| Subject: | Re: Defining PHP varibles from URL | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-96151@lists.php.net to get a copy of this message | ||
On Sun, 5 May 2002, Teemu Pentinsaari wrote:
>>> It could be what I was typing in the url bar.
>>>
>>> file.php?file=foobar.inc
>>
>> 1) Try include $_GET['file'];
>>
>> 2) Let me know where your server is so I can go to
>>
>> http://your.server/file.php?file=/etc/passwd
>
> You might want to use .php file extension and /include/ directory to prevent
> Miquel stealing your pressious passwords :))
http://your.server/file.php?file=../../../etc/passwd%00
miguel