Inj3ct0r has discovered a vulnerability in Wap-motor, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "image" parameter in gallery/gallery.php is not properly sanitised before being used to read files. This can be exploited to read arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.

The vulnerability is confirmed in version 18.0. Prior versions may also be affected.

Solution
Update to version 18.1.

Provided and/or discovered by
Inj3ct0r

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://packetstormsecurity.org/0908-exploits/wapmotor-lfi.txt

Deep Links
Links available to Secunia VIM customers