Zimplit 3.0 Local File Inclusion

`Vulnerability ID: HTB22605  
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_zimplit.html  
Product: Zimplit  
Vendor: Zimplit Ltd. ( http://www.zimplit.com/ )   
Vulnerable Version: 3.0 and Probably Prior Versions  
Vendor Notification: 15 September 2010   
Vulnerability Type: CSRF (Cross-Site Request Forgery)  
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response  
Risk level: Low   
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)   
  
Vulnerability Details:  
The vulnerability exists due to failure in the "zimplit.php" script to properly verify the source of HTTP request.  
  
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.  
  
Attacker can use browser to exploit this vulnerability. The PoC example:  
http://host/zimplit.php?action=load&file=../hello.php  
This PoC leads to the execution of the "hello.php" in the parent folder.  
  
`