Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability

vendor:

Jgrid

by:

Salvatore Fresta aka Drosophila

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Jgrid

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:datagrids.clubsareus.org:jgrid:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability

A parameter is not properly sanitised before being used by the require_once function, allowing a guest to include local files.

Mitigation:

Sanitize the controller parameter before using it in the require_once function.

Source

Exploit-DB raw data:

Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability

 Name              Jgrid
 Vendor            http://datagrids.clubsareus.org
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-08-14

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

DATA GRID Component built on the popular EXTJS Framework.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before being  used
by the require_once function.


III. ANALYSIS
_____________

Summary:

 A) Local File Inclusion
 

A) Local File Inclusion
_______________________

The  controller  parameter in jgrid.php is not  sanitised
before  being  used by the PHP function's require_once().
This allows a guest to include local files. The following
is the affected code:

if($controller = JRequest::getVar('controller')) {
	require_once (JPATH_COMPONENT.DS.'controllers'.DS.$controller.'.php');
}


IV. SAMPLE CODE
_______________

A) Local File Inclusion

http://site/path/index.php?option=com_jgrid&controller=../../../../../../../../etc/passwd%00


V. FIX
______

No fix.