EasyTalk 微博系统 X1.X 文件包含漏洞

PluginsAction.class.php：

class PluginsAction extends Action {

    public function index() {
        $app=$_GET['app'];
        $action=$_GET['action'];
        $out=urldecode($_GET['out']); //注意

        if (@file_exists(ET_ROOT .'/Plugin/'.$app.'/'.$app.'.class.php')) {
            $class = $app.'_action';
            if (class_exists($class)) {
                if (!$out) {
                    $plugin=new $class($this);
                    if ($action) {
                        echo $plugin->$action();
                        exit;
                    } else {
                        if (method_exists($class,page)) {
                            if (!$this->my) {
                                echo '<script type="text/javascript">window.location.href="'.SITE_URL.'/login"</script>';
                                exit;
                            }
                            $content=$plugin->page();
                        }
                    }
                } else {
                    include_once(ET_ROOT .'/Plugin/'.$app.'/'.$out);  //(*^__^*) 嘻嘻 还不限后缀呢
                    exit;
                }
            }
        }