This exploit demonstrates two vulnerabilities in LimeSurvey 1.92+ build 120620: a Remote File Inclusion (RFI) via the `rootdir` parameter in `replacements.php` and a Directory Traversal via the `sFullFilepath` parameter in `importsurvey.php`. Both require specific PHP configurations (`allow_url_include` and `register_globals` for RFI, `display_errors` and `register_globals` for traversal).
Classification
Working Poc 90%
Attack Type
Rce | Info Leak
Target:
LimeSurvey 1.92+ build 120620
No auth needed
Prerequisites:
PHP `allow_url_include` enabled for RFI · PHP `register_globals` enabled for both vulnerabilities · PHP `display_errors` enabled for Directory Traversal