SiteDepth CMS Constants.PHP Remote File Include Vulnerability

Bugtraq ID:	19094
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2006 12:00AM
Updated:	Oct 02 2006 06:00PM
Credit:	David "Aesthetico" Vieira-Kurz is credited with the discovery of this vulnerability.
Vulnerable:	SiteDepth SiteDepth 3.0.1
Not Vulnerable:

SiteDepth CMS Constants.PHP Remote File Include Vulnerability

SiteDepth CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

SiteDepth CMS 3.01 and prior versions are vulnerable to this issue.

SiteDepth CMS Constants.PHP Remote File Include Vulnerability

Attackers can exploit this issue using a web client.

SiteDepth CMS Constants.PHP Remote File Include Vulnerability

Solution:
The vendor has indicated that this issue has been addressed in a patch release; please contact the vendor for more information.

SiteDepth CMS Constants.PHP Remote File Include Vulnerability

References:

• SiteDepth Web Site (SiteDepth)