Looks like this issue was fixed in PHP 5.3 https://bugs.php.net/bug.php?id=39863
PHP ใฏใใกใคใซใทในใใ ้ข้ฃใฎๆไฝใซ C ่จ่ชใฎ้ขๆฐใไฝฟ็จใใฆใใใฎใงใ null ใใคใใฎๅฆ็ใไบๆใใฌใใใกใง่กใใใจใใใใพใใ C ่จ่ชใงใฏ null ใใคใใฏๆๅญๅใฎ็ต็ซฏใ่กจใใฎใงใ null ใใคใใๅซใๆๅญๅใใใฃใๅ ดๅใซ null ใใคใไปฅ้ใฎๅ ๅฎนใฏๆๅญๅใจใใฆๅฆ็ใใใพใใใ ไปฅไธใซใใใฎๅ้กใซ้ขใใ่ๅผฑๆงใๅซใใณใผใไพใ็คบใใพใใ
ไพ1 null ใใคใใซๅฏพใใฆ่ๅผฑใชในใฏใชใใ
<?php
$file = $_GET['file']; // ใใใง "../../etc/passwd\0" ใๆธกใใใใจใใพใ
if (file_exists('/home/wwwrun/' . $file . '.php')) {
// file_exists ใฏ true ใ่ฟใใพใใใใใฏใใใกใคใซ /home/wwwrun/../../etc/passwd ใๅญๅจใใใใใงใ
include '/home/wwwrun/'.$file.'.php';
// ใใกใคใซ /etc/passwd ใใคใณใฏใซใผใใใใฆใใพใใพใ
}
?>ใใใใฃใฆใใใกใคใซใทในใใ ๆไฝใงไฝฟ็จใใใๆฑๆใใใใๆๅญๅใฏใ ใคใญใซ้ฉๅใซๆค่จผใใชใใใฐใชใใพใใใ ๅ ใปใฉใฎไพใๆน่ฏใใใใฎใ็คบใใพใใ
ไพ2 ๅ ฅๅใ้ฉๅใซๆค่จผใใไพ
<?php
$file = $_GET['file'];
// ๅคใจใใฆไธใใใใๅฏ่ฝๆงใฎใใใๆๅนใชๅคใฎไธ่ฆงใไฝๆใใพใ
switch ($file) {
case 'main':
case 'foo':
case 'bar':
include '/home/wwwrun/include/' . $file . '.php';
break;
default:
include '/home/wwwrun/include/main.php';
}
?>Looks like this issue was fixed in PHP 5.3 https://bugs.php.net/bug.php?id=39863clean input of null bytes:
<?php
$clean = str_replace(chr(0), '', $input);
?>