can you tell me how you injected the php code in this site?? thanks in advance. by the way nice writeup.

He didn't inject code. The vulnerability was that any existing file path that he would type into the input, would be read and returned to the client.

You just have to enter paths in the input box, and from there look for common files. Example of geting to /etc/passwd would be typing ../../../../etc/passwd in the input.

@W3ndige you don't need to do relative paths, it would accept absolute paths like /etc/passwd fine.

@argaz - Now i now :D Thanks for the info!