Nova CMS Directory Traversal

`#   
# Title : Nova CMS Directory Travel  
# Author : Red Security TEAM  
# Date : 21/01/2012  
# Download : http://www.nova-cms.com/uploads/files/novacms.zip  
# Tested On : CentOS  
# Dork : Copyright ©2005-2011 by Nova CMS.  
# Contact : Info [ 4t ] RedSecurity [ d0t ] COM  
# Home : http://RedSecurity.COM  
#  
# Exploit :  
#   
# 1. Register  
# 2. Go to forum and click on "NEW TOPIC"  
# 3. In the above tab in editor click on last picture "Attach File"  
# 4. Start Live HTTP headers  
# 5. Add a new allowed file  
# 6. Find dir=uploads%2Fforum%2Fdata-YourUsername2F&options=true&ajax=true and click on Reply on Live HTTP headers  
# 7. Change to dir=uploads%2F , dir=uploads%2Fbackup%2F  
# 8. You can't back to directory before uploads directory but you can see all directory in uploads example another users files and uploads/backup/ ;):D  
#  
`