{"action":"closed","issue":{"url":"https://api.github.com/repos/ethicalhack3r/DVWA/issues/103","repository_url":"https://api.github.com/repos/ethicalhack3r/DVWA","labels_url":"https://api.github.com/repos/ethicalhack3r/DVWA/issues/103/labels{/name}","comments_url":"https://api.github.com/repos/ethicalhack3r/DVWA/issues/103/comments","events_url":"https://api.github.com/repos/ethicalhack3r/DVWA/issues/103/events","html_url":"https://github.com/ethicalhack3r/DVWA/issues/103","id":180449199,"number":103,"title":"Local File Inclusion in Dvwa","user":{"login":"EhsanCod3r","id":17674292,"avatar_url":"https://avatars.githubusercontent.com/u/17674292?v=3","gravatar_id":"","url":"https://api.github.com/users/EhsanCod3r","html_url":"https://github.com/EhsanCod3r","followers_url":"https://api.github.com/users/EhsanCod3r/followers","following_url":"https://api.github.com/users/EhsanCod3r/following{/other_user}","gists_url":"https://api.github.com/users/EhsanCod3r/gists{/gist_id}","starred_url":"https://api.github.com/users/EhsanCod3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EhsanCod3r/subscriptions","organizations_url":"https://api.github.com/users/EhsanCod3r/orgs","repos_url":"https://api.github.com/users/EhsanCod3r/repos","events_url":"https://api.github.com/users/EhsanCod3r/events{/privacy}","received_events_url":"https://api.github.com/users/EhsanCod3r/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-01T10:09:32Z","updated_at":"2016-10-01T10:30:06Z","closed_at":"2016-10-01T10:30:06Z","body":"Hello\r\n\r\n#Exploit:\r\nWith nullbyte can bypass and exploit this vulnerable files.\r\n\r\n#Vulnerable File and codes:\r\n==================\r\nview_help.php\r\n```\r\n11 `$id = $_GET['id']; `\r\n15 `eval('?>' . file_get_contents(DVWA_WEB_PAGE_TO_ROOT . \"vulnerabilities/{$id}/help/help.php\") . '<?php ');`\r\n```\r\n==================\r\nview_source.php\r\n```\r\n11 $id       = $_GET[ 'id' ];\r\n12 $security = $_GET[ 'security' ];\r\n46 $source = @file_get_contents( DVWA_WEB_PAGE_TO_ROOT . \"vulnerabilities/{$id}/source/{$security}.php\" )\r\n```;\r\n==================\r\nview_source_all.php\r\n11-27\r\n```\r\n$id = $_GET[ 'id' ];\r\n\r\n$lowsrc = @file_get_contents(\"./{$id}/source/low.php\");\r\n$lowsrc = str_replace( array( '$html .=' ), array( 'echo' ), $lowsrc);\r\n$lowsrc = highlight_string( $lowsrc, true );\r\n\r\n$medsrc = @file_get_contents(\"./{$id}/source/medium.php\");\r\n$medsrc = str_replace( array( '$html .=' ), array( 'echo' ), $medsrc);\r\n$medsrc = highlight_string( $medsrc, true );\r\n\r\n$highsrc = @file_get_contents(\"./{$id}/source/high.php\");\r\n$highsrc = str_replace( array( '$html .=' ), array( 'echo' ), $highsrc);\r\n$highsrc = highlight_string( $highsrc, true );\r\n\r\n$impsrc = @file_get_contents(\"./{$id}/source/impossible.php\");\r\n$impsrc = str_replace( array( '$html .=' ), array( 'echo' ), $impsrc);\r\n$impsrc = highlight_string( $impsrc, true );\r\n```\r\n\r\nGood Luck/"}}
{"actor":{"display_login":"ethicalhack3r"}}