4b9e53700f
18 changes to exploits/shellcodes 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path TypeSetter 5.1 - CSRF (Change admin e-mail) Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting Online Shopping Alphaware 1.0 - Error Based SQL injection Pharmacy/Medical Store & Sale Point 1.0 - 'email' SQL Injection Setelsa Conacwin 3.7.1.2 - Local File Inclusion Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting Medical Center Portal Management System 1.0 - 'login' SQL Injection Pandora FMS 7.0 NG 749 - Multiple Persistent Cross-Site Scripting Vulnerabilities # Date: 11-14-2020 Social Networking Site - Authentication Bypass (SQli) Tendenci 12.3.1 - CSV/ Formula Injection
32 lines
No EOL
1.3 KiB
Text
32 lines
No EOL
1.3 KiB
Text
# Exploit Title: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
|
|
# Google Dork: inurl:''com_gmapfp''
|
|
# Date: 2020-03-27
|
|
# Exploit Author: ThelastVvV
|
|
# Vendor Homepage: https://gmapfp.org/
|
|
# Version:Version J3.5 /J3.5free
|
|
# Tested on: Ubuntu
|
|
# CVE: CVE-2020-23972
|
|
|
|
# Description:
|
|
|
|
An attacker can access the upload function of the application without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions
|
|
|
|
# PoC:
|
|
|
|
|
|
Version J3.5
|
|
http://127.0.0.1/index.php?option=com_gmapfp&controller=editlieux&tmpl=component&task=edit_upload
|
|
|
|
-Once the attacker can locate the unauthenticated file upload form then the attacker can bypass the restriction by changing content-type and name file double extensions file.html.gif then can open file.html
|
|
|
|
# Impact
|
|
the attacker can upload malicious files can cause defacement of the site or uploading large amount of file til causes denial of service attack to Webapp/Server
|
|
|
|
# Dir File Path:
|
|
http://127.0.0.1///images/stories/gmapfp/test.html.gif
|
|
http://127.0.0.1///images/stories/gmapfp/test.html
|
|
http://127.0.0.1///images/gmapfp/test2.html.gif
|
|
http://127.0.0.1///images/gmapfp/test2.html.gif
|
|
|
|
|
|
# Issues are fixed,Please update to Last Version |