3 ms·
Can anyone explain the injection part? I didn't understand how getting the passwd file helped in any way with injecting a php error, and why code got executed i
by alain94040 17y ago
Can anyone explain the injection part? I didn't understand how getting the passwd file helped in any way with injecting a php error, and why code got executed in the end.
- erydo 17y agoThe passwd file didn't help, it just showed him that he could retrieve arbitrary files via an open/improperly escaped PHP include(). His injected worked by causing an error to be written to a log, and then reading that log back through the PHP include. The error that was logged contained an arbitrary string (the HTTP request, with the malicious PHP code), which was executed by the server.