vendor:
com_realtyna
by:
MISTERFRIBO
7,5
CVSS
HIGH
LFI vulnerability
22
CWE
Product Name: com_realtyna
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
Joomla Component com_realtyna LFI vulnerability
A Local File Inclusion (LFI) vulnerability exists in Joomla Component com_realtyna. An attacker can exploit this vulnerability to read sensitive files on the server. The vulnerable parameter is ‘controller’ which is located in the URL. An attacker can exploit this vulnerability by sending a crafted HTTP request with malicious ‘controller’ parameter value. The malicious value contains relative path traversal characters (../). This will allow the attacker to read sensitive files on the server.
Mitigation:
To mitigate this vulnerability, the application should validate the user input and should not allow any relative path traversal characters (../).
