Joomla! Component com_annonces - Arbitrary File Upload

#Title:Joomla Component com_annonces Upload Vulnerability
# Author: Sid3^effects
# Published: 2010-06-06
# email:[email protected]
# vendor url : http://joomla.clubnautiquemarine.fr/
# google dork : inurl:com_annonces
############################################################################ 
  
        ooooo  .oooooo.  oooooo   oooooo     oooo 
        `888' d8P'  `Y8b  `888.    `888.     .8' 
         888 888           `888.   .8888.   .8' 
         888 888            `888  .8'`888. .8' 
         888 888             `888.8'  `888.8'  
         888 `88b    ooo      `888'    `888' 
        o888o `Y8bood8P'       `8'      `8'    
                                          
-------------------------------------------------------------------------------------- 
#####################Sid3^effects aKa HaRi################################## 
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors] 
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR 
#ShouTZ:kedar,dec0d3r,41.w4r10r      
#spl shoutz:LiquidWorm,gunslinger_ :D   
#Catch us at www.andhrahackers.com or www.teamicw.in 
############################################################################ 
   
Description : 
Simple Ads manager.
Registred user can place a classified ad with description, date , comments, photos and custom fields. Administrator manages the categories of classified ads,
cutomizes fields in categories, validates the ads. The user receives an email after ad creation and after admin validation. User can modify its ad from the
fronted.
Front-end shows a view with ad details (2 template views possible), vendor email contact, and photos.
This component has been developped for the yacht club of french navy whose members may sell their boat.
Contact me if you find something wrong on the component to the email address ajulou at yahoo.fr or if you have translated the component in another language
Module is able to view random or lasted ads
############################################################################ 
  
Xploit : Upload Vulnerability 
  
         
 STEP 1 : Register first :) 
   
 STEP 2 : Goto "Submit an ad"option. 
  
 STEP 3 : The attacker can upload  a shell in the ITEM DESCRIPTION section and your shell gets executed :P 
          
 STEP 4 : Check your ad now in the particular category and find your shell :)
  
submit your ad :
      DEMO URL : 
           http://server/index.php?option=com_annonces&view=edit&Itemid=1 
  
 Once uploaded you can check your ad :P 
  
  
############################################################################ 
#spl thks: exploit-db team
#Sid3^effects