Zend
ZF-100-500 · Question #148
Consider the PHP program (which includes a file specified by request): <?php $color = 'blue'; if (isset( $_GET['COLOR'] ) ) $color = $_GET['COLOR']; require( $color . '.php' ); ?> <form…
The correct answer is C. Remove the .php suffix, allowing access to files other than .php. See the full explanation below for the reasoning.
Question
Consider the PHP program (which includes a file specified by request): <?php $color = 'blue'; if (isset( $_GET['COLOR'] ) ) $color = $_GET['COLOR']; require( $color . '.php' ); ?> <form method="get"> <select name="COLOR"> Zend ZF-100-500 Exam <option value="red">red</option> <option value="blue">blue</option> </select> <input type="submit"> </form> A malicious user injects the following command: /vulnerable.php?COLOR=C:\notes.txt%00 Where vulnerable.php is a remotely hosted file containing an exploit. What does the malicious user want to do?
Options
- APerform a cross-site scripting attack.
- BExecute the malicious code that exists in the file vulnerable.php.
- CRemove the .php suffix, allowing access to files other than .php.
- DInject a remotely hosted file containing an exploit.
How the community answered
(50 responses)- A2% (1)
- B8% (4)
- C74% (37)
- D16% (8)
Community Discussion
No community discussion yet for this question.