The source code of level8 is here. <?php $uploadedFile = sprintf('%1$s/%2$s', '/uploads', sha1($_FILES['fileToUpload']['name']) . '.gif'); if (file_exists ($uploadedFile)) { unlink ($uploadedFile); } if ($_FILES['fileToUpload']['size'] <= 50000) { if (getimagesize ($_FILES['fileToUpload']['tmp_name']) !== false) { if (exif_imagetype($_FILES['fileToUpload']['tmp_name']) === IMAGETYPE_GIF) { move_uploaded_file ($_FILES['fileToUpload']['tmp_name'], $uploadedFile); echo '<p class="lead">Dump of <a href="/level08' . $uploadedFile . '">'. htmlentities($_FILES['fileToUpload']['name']) . '</a>:</p>'; echo '<pre>'; include_once($uploadedFile); echo '</pre>'; unlink($uploadedFile); } else { echo '<p class="text-danger">The file is not a GIF</p>'; } } else { echo '<p class="text-danger">The file is not an image</p>'; } } else { echo '<p class="text-danger">The file is too big</p>'; } ?

The source code for level2 is here. <?php ini_set('display_errors', 'on'); class LevelTwo { public function doQuery($injection) { $pdo = new SQLite3('leveltwo.db', SQLITE3_OPEN_READONLY); $searchWords = implode (['union', 'order', 'select', 'from', 'group', 'by'], '|'); $injection = preg_replace ('/' . $searchWords . '/i', '', $injection); $query = 'SELECT id,username FROM users WHERE id=' . $injection . ' LIMIT 1'; $getUsers = $pdo->query ($query); $users = $getUsers->fetchArray (SQLITE3_ASSOC); if ($users) { return $users; } return false; } } if (isset ($_POST['submit']) && isset ($_POST['user_id'])) { $lt = new LevelTwo (); $userDetails = $lt->doQuery ($_POST['user_id']); } ?