TalkPHP - View Single Post - PHP Injection

codefreek · 07-02-2008, 09:31 AM

u can fix it like this..

PHP Code:


			
<?php
if (!empty($_GET['file'])) {
    $q = substr($_GET['file'], strrpos($_GET['file'], '/')+1);
    if (is_readable($q)) {
        include $_GET['file'].'.php';
    }
}
?>

07-02-2008, 09:31 AM	#2 (permalink)
codefreek Super Moderator Join Date: Sep 2007 Location: Near you. Posts: 791 Thanks: 241	u can fix it like this.. PHP Code: `<?php if (!empty($_GET['file'])) { $q = substr($_GET['file'], strrpos($_GET['file'], '/')+1); if (is_readable($q)) { include $_GET['file'].'.php'; } } ?>` __________________ Codefreek's - News Letter, Tech, & some random ramblings