🇰🇷 한글 설명
phpProfiles 2.1 Beta의 다중 PHP 원격 파일 포함(RFI) 취약점으로, 사용자 입력이 검증되지 않은 reqpath 및 usrinc 매개변수를 통해 공격자가 임의의 PHP 코드를 원격 실행할 수 있다. 웹 애플리케이션의 완전한 장악으로 이어질 수 있는 심각한 결함이다.
💡 쉬운 설명
This vulnerability lets attackers trick your website into loading and running malicious PHP code from external sources by manipulating certain URL parameters. If your site uses old phpProfiles software, hackers can completely take over it.
🇺🇸 원문 (English)
Multiple PHP remote file inclusion vulnerabilities in phpProfiles 2.1 Beta allow remote attackers to execute arbitrary PHP code via a URL in the (1) reqpath parameter to (a) body.inc.php and (b) body_blog.inc.php in users/include/; or the (2) usrinc parameter in users/include/upload_ht.inc.php.
📍 영향받는 시스템
phpProfiles version 2.1 Beta and earlier; affects users/include/body.inc.php, body_blog.inc.php, and upload_ht.inc.php
⚔️ 공격 벡터
Remote attacker crafts malicious URLs with external file paths in reqpath or usrinc parameters to execute arbitrary PHP code on the target server
🛡️ 대응 방법
Immediately update phpProfiles to version 2.2+ or disable PHP remote file inclusion via php.ini (allow_url_include = Off)
🔧 검증 코드
If output shows file paths, phpProfiles is installed and requires immediate patching; if 'Not found', application is not present on this system
find / -path '*/users/include/body.inc.php' -o -path '*/users/include/upload_ht.inc.php' 2>/dev/null | head -1 && echo 'Vulnerable files found' || echo 'Not found'