TomatoCart 1.2.0 Alpha 2 Local File Inclusion

`Information  
--------------------  
Name : Local File Inclusion Vulnerability in TomatoCart  
Software : TomatoCart 1.2.0 Alpha 2 and possibly below.  
Vendor Homepage : http://www.tomatocart.com  
Vulnerability Type : Local File Inclusion  
Severity : Critical  
Researcher : Canberk Bolat  
Advisory Reference : NS-12-004  
  
Description  
--------------------  
TomatoCart is a professional and innovative open source eCommerce  
solution. The back-end is an impressive desktop-like ExtJS-powered  
interface, offering significant usability improvements and user  
experience. It's the most easy-to-use shopping cart.  
  
Details  
--------------------  
TomatoCart is affected by a Local File Inclusion vulnerability in  
version 1.2.0 Alpha 2.  
Example PoC url is as follows :  
http://example.com/json.php?action=3&module=../../../../../../../../../../../../../../boot.ini%00  
  
You can read the full article about Local File Inclusion vulnerability  
from here :  
  
http://www.mavitunasecurity.com/local-file-inclusion/  
  
Solution  
--------------------  
No patch released.  
  
Advisory Timeline  
--------------------  
30/09/2011 - First contact: No response  
26/12/2011 - Second contact: No response  
28/03/2012 - Vulnerability Released  
  
Credits  
--------------------  
It has been discovered on testing of Netsparker, Web Application  
Security Scanner - http://www.mavitunasecurity.com/netsparker/.  
  
References  
--------------------  
MSL Advisory Link :  
http://www.mavitunasecurity.com/local-file-inclusion-vulnerability-in-tomatocart/  
Netsparker Advisories : http://www.mavitunasecurity.com/netsparker-advisories/  
  
About Netsparker  
--------------------  
Netsparker® can find and report security issues such as SQL Injection  
and Cross-site Scripting (XSS) in all web applications regardless of  
the platform and the technology they are built on. Netsparker's unique  
detection and exploitation techniques allows it to be dead accurate in  
reporting hence it's the first and the only False Positive Free web  
application security scanner.  
  
--   
Netsparker Advisories, <[email protected]>  
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/  
  
`