EllisLab/CodeIgniter — Issue #568: Local file inclusion
Author: ErikNijland
Created: 2011-10-13 09:58:26+00:00
State: open

When setting $config['enable_query_strings'] to true CodeIgniter becomes vulnerable for local file inclusion.

E.g.
http://www.example.com/index.php?c=../../../some/folders/.htpasswd%00

Where %00 represents a null-byte character. See http://ddxhunter.wordpress.com/2010/03/10/lfis-exploitation-techniques/ for a more detailed explanation of local file inclusion.