Description
Multiple critical vulnerabilities exist in Siteman 2.x, including remote code execution (RCE), local file inclusion (LFI), and cross-site scripting (XSS). The application fails to properly validate user input across multiple entry points.
Impact
Remote code execution allows attackers to execute arbitrary PHP code on the server, leading to complete system compromise. LFI allows reading sensitive files. XSS enables session hijacking. The combination of these vulnerabilities gives attackers full control over the web application and potentially the underlying server.
Solution
Upgrade to a maintained CMS. If Siteman 2.x must be used, apply strict input validation, disable dangerous PHP functions, and restrict file permissions.