MyBB 1.2 Local File Incusion

Invalid characters removed from From: o.y.6@xxxxxxxxxxx, |@securityfocus.com,

#### D3vil-0x1 MyBB Bug ###
## Local File Inclusion
##
## MyBB 1.2 -> Admin Can Include Local File :)

## File :- admin/plugins.php

Line :- 51
//*

if($mybb->input['action'] == "activate")

{

$codename = $mybb->input['plugin']; << Input From POST

$file = $codename.".php"; << Set File Type [ we can remove the type by NULL ( %00 ) ]

if($mybb->input['activate'])

{

.....
.....

}

elseif($mybb->input['deactivate'])

{

.....
.....

}



include "./inc/plugins/$file"; << Include BIG BUG :P

*//
#---------------------------------------------------------#