Local File Inclusion Vulnerability in DZCP

High-Tech Bridge SA Security Research Lab has discovered vulnerability in DZCP which could be exploited to include and execute arbitrary local files on the target system.

1) Local file inclusion in DZCP
Input passed to the " [prefix]_language" cookie in index.php is not properly sanitized before being used to include local files. A remote attacker can include arbitrary files on the target system using directory traversal sequences.
Exploitation example:
Cookie: [prefix]_language=../../../1;