title: PHP file_get_contents vulnerability
body: <p>I'm assessing security of a webportal for a client and I found a vulnerability.</p>
  
  <p>This is the PHP code:</p>
  
  <pre><code>echo(file_get_contents("template/data/" $_GET['id']));
  </code></pre>
  
  <p>I was able to successfully read ../../../index.php, config.php etc. </p>
  
  <p>But I just want to be able to prove that this bug is more critical than reading configs. I read the MySQL user/pass, but I can't connect to it since its listening on localhost only. All other codes I read, didn't lead to anything. So basically all I got was just some source code which was kinda no secret.</p>
  
  <p>I can't do php filter stuff because it has "template/data/" in the beginning of string.</p>
  
  <p>What else can be done with this vulnerable piece of code? Any ideas?</p>