Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: gcards (languagefile) <= Remote File Include

From: str0ke (str0kemilw0rm.com)
Date: Wed Oct 11 2006 - 14:55:58 CDT

> Exploit
> gcards/admin/addnews.php?languagefile=shell code

gCards Version 1.13

22 include_once('../config.php'); # the variable is defined
23 include_once('../inc/UIfunctions.php'); # no variable change
24 include_once('loginfunction.php'); # just a couple functions
25 include_once('../inc/smileyClass.php'); # just a single class
26 include_once("../inc/".$languageFile); # the only include with $languageFile

$languageFile is defined on line 93 of config.php, by default to

Maybe im missing where the vulnerability is?