This Perl script exploits a Remote File Inclusion (RFI) vulnerability in VWar <= 1.5.0 R12 by injecting a malicious URL into the 'vwar_root' parameter of 'get_header.php', allowing remote command execution via an external PHP shell.
Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target:VWar <= 1.5.0 R12
No auth needed
Prerequisites:Access to the target VWar installation · External PHP shell hosted on an attacker-controlled server