[imgoodatcpa]

Hey all!

I'm new to this forum and let me say that it looks cool.

I have a question for y'all:

How would you exploit a PHP endpoint (Nginx server) which uses file_put_contents to log all that comes from post request?

Let me give you a code example:

function logtxt($log)
{
        $log .= "\n";
        $bt = debug_backtrace();
        $caller = array_shift($bt);
        $line = $caller['line'];
        file_put_contents('./log_' . date("j.n.Y") . '.log', $line . ':' . $log, FILE_APPEND);
}

$message= json_decode(file_get_contents('php://input'),true);

logtxt(json_encode($message));