Description
A remote file disclosure vulnerability exists in Siteman 1.1.9 through the cat parameter. The application allows reading arbitrary files from the server by manipulating the parameter value.
Impact
An attacker can read sensitive files on the server, including configuration files with database credentials, .htaccess files, and other files outside the web root.
Solution
Apply strict input validation to the cat parameter. Use a whitelist of allowed values.