Joomla Component com_annonces Upload Vulnerability

vendor:

Joomla Component com_annonces

by:

Sid3^effects

9,3

CVSS

HIGH

File Upload Vulnerability

434

CWE

Product Name: Joomla Component com_annonces

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: CVE-2010-2590

CPE: a:joomla:joomla

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2010

Joomla Component com_annonces Upload Vulnerability

A vulnerability in the Joomla Component com_annonces allows an attacker to upload arbitrary files, including malicious PHP files, which results in arbitrary remote code execution. This vulnerability is due to insufficient validation of the file type being uploaded. An attacker can exploit this vulnerability by uploading a malicious PHP file with a double extension such as “file.php.jpg”.

Mitigation:

Upgrade to the latest version of the Joomla Component com_annonces.

Source

Exploit-DB raw data:

#Title:Joomla Component com_annonces Upload Vulnerability
# Author: Sid3^effects
# Published: 2010-06-06
# email:shell_c99@yahoo.com
# vendor url : http://joomla.clubnautiquemarine.fr/
# google dork : inurl:com_annonces
############################################################################

ooooo .oooooo. oooooo oooooo oooo
`888' d8P' `Y8b `888. `888. .8'
888 888 `888. .8888. .8'
888 888 `888 .8'`888. .8'
888 888 `888.8' `888.8'
888 `88b ooo `888' `888'
o888o `Y8bood8P' `8' `8'

--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r
#spl shoutz:LiquidWorm,gunslinger_ :D
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################

Description :
Simple Ads manager.
Registred user can place a classified ad with description, date , comments, photos and custom fields. Administrator manages the categories of classified ads,
cutomizes fields in categories, validates the ads. The user receives an email after ad creation and after admin validation. User can modify its ad from the
fronted.
Front-end shows a view with ad details (2 template views possible), vendor email contact, and photos.
This component has been developped for the yacht club of french navy whose members may sell their boat.
Contact me if you find something wrong on the component to the email address ajulou at yahoo.fr or if you have translated the component in another language
Module is able to view random or lasted ads
############################################################################

Xploit : Upload Vulnerability

STEP 1 : Register first :)

STEP 2 : Goto "Submit an ad"option.

STEP 3 : The attacker can upload a shell in the ITEM DESCRIPTION section and your shell gets executed :P

STEP 4 : Check your ad now in the particular category and find your shell :)

submit your ad :
DEMO URL :
http://server/index.php?option=com_annonces&view=edit&Itemid=1

Once uploaded you can check your ad :P

############################################################################
#spl thks: exploit-db team
#Sid3^effects