ServerNest — LFI to RCE via Locale Loading

hackadvisor

Task: PHP game server management panel with locale/i18n loading endpoint vulnerable to path traversal via namespace parameter. Solution: discovered unauthenticated /locales/locale.json endpoint from JavaScript source, exploited LFI in namespace parameter to read /proc/self/environ and extract the flag from environment variables.