[mlaux]

Typically seen more often as something like:

    http://example.com/viewPost.php?post=../../../whatever

(where the server side code has the bug, not the web server configuration itself)

[hinkley]

We got access logs like this all the time. SaaS app with separate domain per customer so we got a lot of probes like this.

Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

[mschuster91]

> Famously IIS had some bugs like this. Not surprised that PHP has problems. What a clown car.

This is a file inclusion vulnerability. And that's something that is _very_ easily done in any language which people use to do stuff that loads files from the file system. Image resizers are a pretty common exploit path.

[Dylan16807]

That is not an example of a php problem. There is no "post=filename" feature in php; it's running webdev code. They only used .php because it's a very common language.