CVE-2006-0660

This exploit leverages a path traversal vulnerability in FarsiNews 2.5Pro to read the contents of the users.db.php file, exposing usernames and MD5-hashed passwords. The exploit constructs a malicious URL with a null byte to bypass file extension checks and retrieve sensitive data.

The exploit describes directory traversal and local file inclusion vulnerabilities in FarsiNews due to improper input sanitization. It allows attackers to retrieve arbitrary files or include local files, potentially leading to arbitrary code execution if malicious scripts are present.