0

I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library.

Here are the things I found I can make this library do for me:

  • Include (include_once call) any file on disk that ends with .php or .class.php
  • If included file has class definition in it with same name as file name, create $obj - an instance of this class with no arguments provided to constructor.
  • Invoke $obj->$key = $val on this class instance where $key is string and $val may be string, number, array, bytearray, or another object created as this one.
  • If object (class) has init method, call this method.

Is this (maybe if some conditions are met) is vulnerable in any way? Thinking about RCE.

Network include of files seems not to be possible. The path starts mandatory with slash /. And resulting path is checked with file_exists before inclusion.

  • If you can find a way to do an include_once on any arbitrary file, including ones served over a network, without directly editing code on the server? Then yes, there's an RCE vulnerability... As it is, though, there's nothing in what you said that makes me think that there's any vulnerability. -- Keep poking at it, though. I can't say it's not vulnerable, so I won't give an answer, but based on the information here, a vulnerability isn't in evidence. – Ghedipunk May 9 at 18:45
  • @Ghedipunk network include is not possible. The path starts mandatory with slash /. And resulting path is checked with file_exists before inclusion. – Alex Velickiy May 9 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.