bugtraq - Re: Sitellite cms <= 4.2.12 RFI Vuln

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070619050932.11957.qmail@securityfocus.com>
Date: 19 Jun 2007 05:09:32 -0000
From: lux@...ian.ca
To: bugtraq@...urityfocus.com
Subject: Re: Sitellite cms <= 4.2.12 RFI Vuln

Sitellite requires .htaccess capabilities from Apache to configure its content server, so the .htaccess "deny from all" which we include in the PhpDocumentor folder effectively prevents this exploit for all Sitellite installations.

PhpDocumentor is only accessible in Sitellite on the command line for the purposes of generating API documentation.  This has been the case since Sitellite 4.2.0-rc3.