vendor:
docman Component
by:
Hugo Santiago dos Santos
7.5
CVSS
HIGH
Full Path Disclosure & Local File Disclosure/Include
200, 98
CWE
Product Name: docman Component
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2015
Joomla docman Component ‘com_docman’ Full Path Disclosure(FPD) & Local File Disclosure/Include(LFD/LFI)
Joomla docman Component 'com_docman' is vulnerable to Full Path Disclosure(FPD) & Local File Disclosure/Include(LFD/LFI). An attacker can exploit this vulnerability to gain access to sensitive information such as the server path and configuration file. The vulnerability is due to the lack of proper input validation when handling user-supplied input. An attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable application. The FPD vulnerability can be exploited by sending a request with a blank parameter to the vulnerable application. The LFD/LFI vulnerability can be exploited by sending a request with a malicious parameter to the vulnerable application.
Mitigation:
Input validation should be performed to ensure that user-supplied input is properly sanitized. Access to sensitive files should be restricted.
