Joomla Front-End Article Manager System Upload Vulnerability

vendor:

Front-End Article Manager System

by:

Sid3^effects aKa HaRi

9,3

CVSS

HIGH

Joomla Front-End Article Manager System Upload Vulnerability

434

CWE

Product Name: Front-End Article Manager System

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Front-End Article Manager System Upload Vulnerability

The Front-end article manager system is a simple and very powerful extention, that allows users to manage articles directly from front-end. A vulnerability exists in the system which allows an attacker to upload a malicious file to the server, allowing them to execute arbitrary code on the server.

Mitigation:

Ensure that the system is configured to only allow the upload of files with the appropriate file extensions.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Joomla Front-End Article Manager System Upload Vulnerability
Date : july 4,2010
Critical Level 	: HIGH
vendor URL :http://b-elektro.no/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
The Front-end article manager system is a simple and very powerful extention, that allows users to manage articles directly from front-end. The system is an article manager that povides various of features, like management of articles,create,edit,delete, publish, approval, notification etc.

The system also provides some access control based on user groups or individual users.This gives you the opportunity to create personal blogs, front-end approvement systems, create submition restriction and so on. The users and administrator of the site no longer need to use, or learn how to navigate in back-end to manage articles.
The system consists of two modules for creating and deleting articles,
and a template overrider.

#######################################################################################################
Xploit :Upload  Vulnerability

DEMO URL :http://server/

Step 1 : Register :D 

Step 2 : Now go to your page and select "NEW " 

DEMO URL:http://server/index.php?view=article&id=9312&task=edit&option=com_content&ret=aHR0cDovL2ItZWxla3Ryby5za2oubm8vaW5kZXgucGhwP29wdGlvbj1jb21fY29udGVudCZ2aWV3PWNhdGVnb3J5JmxheW91dD1ibG9nJmlkPTExJkl0ZW1pZD0xOA==

Step 3 : Now upload the evil php script in the text place :P

Step 4 : now check your blog and upload the shell 

DEMO URL :http://server/index.php?option=com_content&view=category&layout=blog&id=11&Itemid=18

###############################################################################################################
# 0day no more 
# Sid3^effects