Local File Inclusion in PluXml

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks.

1. Local File Inclusion in PluXml
   1.1 Input passed via the “default_lang” POST parameter to /update/index.php is not properly verified before being used in include_once() function and can be exploited to include arbitrary local files.
   This can be exploited to include local files via directory traversal sequences and URL-encoded NULL bytes.
   The following PoC (Proof of Concept) demonstrates the vulnerability:
   POST /update/index.php HTTP/1.1
   […]
   Content-Type: application/x-www-form-urlencoded
   Content-Length: […]

default_lang=…%2F…%2F…%2F…%2F…%2F…%2F…%2Fetc%2Fpasswd%00