Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <?php
- $id = $_GET["id"]; //Vulnerable Parameter
- $con=mysqli_connect("localhost","root","","tutorial");
- $result = mysqli_query($con, "SELECT `filename`, `location` FROM `downloads` where `id`=$id");
- while($row = mysqli_fetch_row($result))
- {
- $filename = $row[0];
- $location = $row[1];
- }
- mysqli_close($con);
- header('Content-Disposition: attachment; filename='.$filename);
- readfile($location);
- ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement