Exploiting PHP preg_replace( ) function

 Introduction:

The preg_replace() function returns a string or array of strings where all matches of a pattern or list of patterns found in the input are replaced with substrings. 

Usage: preg_replace(patterns, replacements, input, limit, count)

This is a userful function but when handled incorrectly could cause severe damage as great as RCE.

Exploitation:

For example see this: 

this will output: world world

No problem, right? But the problem arises if we use this /e modifier in the PHP preg_funtions which allows the PHP code to be executed.

So now lets add the /e modifier and read the contents of index.php

Output

et Voila!

 This was just an example but in real life same thing could be used but with some more complex payloads.

Have nice day.

                                        -DarkRider88