This host is installed with DirPHP and is prone to local file inclusion vulnerability.

Successful exploitation will allow remote attackers to read arbitrary files on the target system. Impact Level: Application

No solution or patch is available as of 9th February, 2015. Information regarding this issue will be updated once the solution details are available. or updates refer to http://sourceforge.net/projects/dirphp

Flaw is due to the index.php script not properly sanitizing user input, specifically absolute paths supplied via the 'phpfile' parameter.

DirPHP version 1.0

Send a crafted data via HTTP GET request and check whether it is able to read local file or not.

• http://bot24.blogspot.in/2014/07/dirphp-10-lfi-vulnerability.html
• http://packetstormsecurity.com/files/127642
• http://www.exploit-db.com/exploits/34173

---

Updated on 2017-03-28