Leaking File Contents with a Blind File Oracle in Flarum Introduction Flarum is a free, open source PHP-based forum software used for everything from gaming hobbyist sites to cryptocurrency discussion. A quick survey on Shodan suggests there are over 1200 installs exposed to the internet. Through our research we were able to leak the contents of arbitrary local files in Flarum through a blind orac...