Magiccard.cgi has a directory traversal bug in the page variable that allows any file on the system to be read.