This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in OpenX (phpAdsNew) version 2.0. The vulnerability is located in the `lib-remotehost.inc.php` file, where the `phpAds_geoPlugin` parameter is included without proper sanitization, allowing an attacker to include a remote shell.
Classification
Working Poc 90%
Target:
OpenX (phpAdsNew) 2.0
No auth needed
Prerequisites:
Remote file inclusion must be enabled on the target server · Attacker must be able to host a malicious file on a remote server