Description
Multiple directory traversal vulnerabilities in SiteX 0.7.4 Build 418 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the THEME_FOLDER parameter to (1) Corporate/homepage.php, (2) Fusion/homepage.php, (3) Joombo/homepage.php, (4) Streamline/homepage.php, and (5) Structure/homepage.php in themes/.
Affected products
- bjsintay / sitex0.7.4
- bjsintay / sitex0.6.4_beta – 0.6.4_beta
- bjsintay / sitex0.7.1_beta – 0.7.1_beta
- bjsintay / sitex0.7.2_beta – 0.7.2_beta
- bjsintay / sitex0.7.3 – 0.7.3
- bjsintay / sitex0.7.3_beta – 0.7.3_beta
- bjsintay / sitex0.7.4_beta – 0.7.4_beta
- bjsintay / sitex0.7_beta – 0.7_beta