FlatNux 2011-01.26 Denial Of Service / Path Disclosure

`=====================================  
Vulnerability ID: HTB22835  
Reference: http://www.htbridge.ch/advisory/dos_denial_of_service_risk_in_flatnux.html  
Product: FlatNux  
Vendor: Alessandro Vernassa ( http://www.flatnux.altervista.org/ )   
Vulnerable Version: flatnux-2011-01.26 and probably prior versions  
Vendor Notification: 03 February 2011   
Vulnerability Type: DoS (Denial of Service) Risk  
Status: Fixed by Vendor  
Risk level: Low   
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)   
  
Vulnerability Details:  
This attack can be aimed to block the website. The following PoC is available:  
http://host/login.html?mod[]=login&op=modprof&user=dos  
Also this generated an error that will reveal the full path of the script.  
Solution: Upgrade to the most recent version  
  
=====================================  
Vulnerability ID: HTB22834  
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_flatnux.html  
Product: FlatNux  
Vendor: Alessandro Vernassa ( http://www.flatnux.altervista.org/ )   
Vulnerable Version: flatnux-2011-01.26 and probably prior versions  
Vendor Notification: 03 February 2011   
Vulnerability Type: Path disclosure  
Risk level: Low   
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)   
  
Vulnerability Details:  
The vulnerability exists due to failure in the "config.php", "include/functions_php.php", "sections/05_Gallery/section.php", "include/extra/fck3/filemanager.php" scripts, it's possible to generate an error that will reveal the full path of the script.  
A remote user can determine the full path to the web root directory and other potentially sensitive information.  
The following PoC is available:  
  
http://host/config.php  
http://host/include/functions_php.php  
http://host/gallery.html?dir=./test  
http://host/include/extra/fck3/filemanager.php  
  
  
`