title: Trying to understand Local File Inclusion of php command: include 'sql.php?/../../etc/passwd'
body: <p>I was looking into a phpMyAdmin security vulnerability (CVE-2018–12613) and the best write-up of it doesn't explain a very crucial technical detail.  </p>
  
  <p>It just says: "index.php runs include 'sql.php?/../../etc/passwd', and PHP has this magic to convert the path to ../etc/passwd, without checking if the directory sql.php? exists or not. "</p>
  
  <p>Can anyone help me understand this?
  <a href="https://medium.com/@happyholic1203/phpmyadmin-4-8-0-4-8-1-remote-code-execution-257bcc146f8e" rel="nofollow noreferrer">https://medium.com/@happyholic1203/phpmyadmin-4-8-0-4-8-1-remote-code-execution-257bcc146f8e</a></p>
  
  <p>The php manual has some info about this, for example John Carty wrote how you can inject some code using your own website, but that doesn't explain my case. 
  <a href="https://www.php.net/manual/en/function.include.php" rel="nofollow noreferrer">https://www.php.net/manual/en/function.include.php</a></p>
  
  <p>When i wrote the following line into my own apache2 laravel php server:</p>
  
  <pre><code>include('../../../etc/passwd');
  </code></pre>
  
  <p>Then I got the contents of etc/passwd on my page, but writing </p>
  
  <pre><code>include('sql.php?../../../etc/passwd');
  </code></pre>
  
  <p>or </p>
  
  <pre><code>include('index.php?../../../etc/passwd');
  </code></pre>
  
  <p>do nothing. What am I missing?</p>
  
  <p>The result be that the include command:</p>
  
  <pre><code>include 'sql.php?/../../etc/passwd'
  </code></pre>
  
  <p>only includes '../../../etc/passwd'</p>