file inclusion vulnerability

[cilan2]

Require:
PHP Version <5.3.4
magic_quotes_gpc=off
1.
require $index_file
$index_file = '../mc-files/posts/index/'.$post_old_state.'.php'
$post_old_state = $data['state']

2.
write a page or article with content

3.
can see url is

so filename is 2kbz44.bat
4.use burppsuite,we can find phpinfo in response