Joomla com_eportfolio Upload Vulnerability

vendor:

E-portfolio

by:

Sid3^effects aKa HaRi

7,5

CVSS

HIGH

Upload Vulnerability

N/A

CWE

Product Name: E-portfolio

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla com_eportfolio Upload Vulnerability

Advanced access control will let a user decide who will be able to read and comment his joomla portfolio. There are many configuration features like the ability to upload files to portfolio, calendar and events by users and others. Attackers can upload their shells in the options Achievements • Plans • Events • Pages. After uploading the shell, attackers can check their shell and root the server.

Mitigation:

Ensure that the access control is properly configured and users are not allowed to upload malicious files.

Source

Exploit-DB raw data:

1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla com_eportfolio Upload  Vulnerability
Date : june, 20 2010
Critical Level 	: HIGH
Vendor Url : http://www.joomplace.com/e-portfolio/e-portfolio-description.html
Google Dork:inurl:com_eportfolio
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Advanced access control will let a user decide who will be able to read and comment his joomla portfolio. There are many configuration features like the ability to upload files to portfolio, calendar and events by users and others.

Who can use E-portfolio?

* professionals wanting to have their own advanced blog with features such as forum and calendar
* people looking for job to list their CV's
* students and graduates having their portfolio ONLINE to be visible for teachers, parents, CEOs, etc.
* anyone who wants the worls to know who they are, what they do and have already done!
###############################################################################################################

Xploit:Upload  Vulnerability

STEP 1: Always register as a user :P

STEP 2: Select any of the options Achievements •  Plans •  Events •  Pages.

DEMO URL :http://server/index.php?option=com_eportfolio&Itemid=1&task=viewlinks&user=71

STEP 3: Now the attackers can upload their shells in the above options :)

DEMO URL : http://server/index.php?option=com_eportfolio&Itemid=18&task=personal&user=71

STEP 4: Now you can check your shell n root the server :P
###############################################################################################################
# 0day no more 
# Sid3^effects