webPromedium
PageForge
hackadvisor
Task: PHP CMS with unsanitized include() on a view parameter, Apache log readable via open_basedir. Solution: LFI via path traversal to read Apache access log, then User-Agent log poisoning with PHP webshell (single quotes!) to achieve RCE and read flag from environment variable.
$ ls tags/ techniques/
path_traversallfi_to_rceuser_agent_injectionapache_log_poisoningenvironment_variable_exfiltration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 161 — PageForge — Path Traversal via Mixed Slash Filter Bypass— hackadvisor
- [web][Pro]PageCraft — LFI to RCE via /proc/self/environ User-Agent Injection— hackadvisor
- [web][Pro]Lab 254 — PageForge — ZIP Upload File Type Bypass to RCE— hackadvisor
- [web][Pro]DocuNest— hackadvisor
- [web][Pro]PageCraft — SSTI via Twig Template Engine in Post Content— hackadvisor