I'm participating in one bugbounty program. This site runs on php (Apache) and uses amfphp library.
Here are the things I found I can make this library do for me:
- Include (
include_oncecall) any file on disk that ends with .php or .class.php
- If included file has class definition in it with same name as file name, create
$obj- an instance of this class with no arguments provided to constructor.
$obj->$key = $valon this class instance where
$keyis string and
$valmay be string, number, array, bytearray, or another object created as this one.
- If object (class) has
initmethod, call this method.
Is this (maybe if some conditions are met) is vulnerable in any way? Thinking about RCE.
Network include of files seems not to be possible. The path starts mandatory with slash /. And resulting path is checked with
file_exists before inclusion.