Description
当在Windows上运行时，在QSF Portal 1.4.5之前版本中使用的Quicksilver Forums 1.4.2及之前版本中的global.php的get_lang函数中存在目录遍历漏洞。远程攻击者可以借助到index.php的lang参数中的“\”，包含并执行任意本地文件，这会绕过保护机制，因为该保护机制只验证“/”。
Quicksilver Forums本地文件包含和任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://pentest-tools.com/vulnerabilities-exploits/quicksilver-forums-local-file-include-and-arbitrary-file-upload-vulnerabilities_18395
https://exchange.xforce.ibmcloud.com/vulnerabilities/46823
https://nvd.nist.gov/vuln/detail/CVE-2008-7064
https://www.exploit-db.com/exploits/7217
https://www.cve.org/CVERecord?id=CVE-2008-7064
https://www.cvedetails.com/version-list/3604/6300/1/Quicksilver-Forums-Quicksilver-Forums.html