Ruijie Phpinfo

What is the "Ruijie Phpinfo" module?

The "Ruijie Phpinfo" module is a test case designed to detect misconfigurations in the Ruijie network device. It specifically targets the "phpinfo.view.php" file and checks for the presence of certain PHP version and extension information. The severity of this module is classified as low.

This module was authored by pikpikcu.

Impact

If the "Ruijie Phpinfo" module detects a misconfiguration, it indicates that the "phpinfo.view.php" file is accessible and may expose sensitive information about the PHP environment. This could potentially aid attackers in identifying vulnerabilities or weaknesses in the system.

How does the module work?

The "Ruijie Phpinfo" module sends a GET request to the "/tool/view/phpinfo.view.php" path on the target Ruijie network device. It then applies two matching conditions:

- The module checks if the response contains the words "PHP Version" and "PHP Extension". This indicates that the PHP version and extension information is exposed. - The module also verifies that the response status is 200, indicating a successful request.

If both matching conditions are met, the module reports a vulnerability.

Example HTTP request:

GET /tool/view/phpinfo.view.php

The module expects the response to contain the words "PHP Version" and "PHP Extension" and have a status code of 200.

For more information, you can refer to the reference on GitHub.