Joomla je-media-player LFI Vulnerability

vendor:

je-media-player

by:

Sid3^effects aKa HaRi

9,3

CVSS

HIGH

LFI Vulnerability

CWE

Product Name: je-media-player

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla je-media-player LFI Vulnerability

There is a Local File Inclusion (LFI) vulnerability in Joomla je-media-player component. An attacker can exploit this vulnerability by sending a crafted HTTP request with maliciously crafted parameters to the vulnerable application. This can allow the attacker to read sensitive files from the server.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in file operations.

Source

Exploit-DB raw data:

Name : Joomla je-media-player LFI Vulnerability
Date : june, 26 2010
Critical Level : HIGH
Vendor Url : http://joomlaextensions.co.in/extensions/components/je-media-player.html
Google Dork: inurl:/components/je-media-player.html?
Price:$15.00
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
There are three different manager in that component :-

1. Album Management
2. Song Management
3. Setting

1. Album Management :- Admin can add,edit ,delete,published and unpublished the album photo,name and description. Create the thumbnail for

that album photo. User can configure the album photo size from the configuration.

2. Song Management :- Admin can upload song into the particular album. Song name and description add,edit and delete from the song

management.

3.Setting :- Configure the album thumbnail width and height. Also configure the player width and height.

#######################################################################################################
Xploit:LFI Vulnerability

DEMO URL : http://server/demo/components/je-media-player.html?view=../../

############################################################################################################