Magiccard.cgi has a directory traversal bug in the page variable that allows any file on the system to be read.
ebeddfd494c8d0021e0b86e2f8493f37740875b8485e7be7afedc4a1cf819632
This exploit hangs WiredRed e/pop v2.0.3, probably works on all 2.x versions. Ported to Windows w/ Cygwin.
b888ff0b10bd0e61f49601ca8df8a50dd62484cc687f644e99ca6b9d20341fd0