Joomla Component Foobla Suggestions Local File Inclusion

vendor:

foobla Suggestions

by:

Chip D3 Bi0s

N/A

CVSS

N/A

Local File Inclusion

CWE

Product Name: foobla Suggestions

Affected Version From: 1.5.1.2

Affected Version To: 1.5.1.2

Patch Exists: NO

Related CWE: N/A

CPE: a:foobla:foobla_suggestions:1.5.1.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component Foobla Suggestions Local File Inclusion

A vulnerability exists in foobla Suggestions version 1.5.1.2 which allows an attacker to include a local file by manipulating the 'controller' parameter in the URL. An attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application.

Source

Exploit-DB raw data:

-----------------------------------------------------------------------------------------
Joomla Component Foobla Suggestions Local File Inclusion
-----------------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Email		: chipdebios[alt+64]gmail.com
Date		: April 08, 2010
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   	: foobla Suggestions
version       	: 1.5.1.2
Developer     	: foobla
License       	: GPL            type  : Commercial
Date Added    	: Dec 21, 2009
Download      	: http://foobla.com/products/featured-joomla-extensions/foobla-suggestions-for-joomla.html

Description   	:

Have you ever used Uservoice? Would you like to have something similar on Joomla but with unlimited features and no monthly fee?

The foobla Suggestions allows you to collect ideas, suggestions, and votes from your cutomers. For more information check out the features list, screenshots, and demo.

FEATURES

* GNU/GPL license. Purchase, install in unlimited domains and get professional support.
* AJAX base for frontend.
* Allow to import ideas from Uservoice account.
* Bad words filter.
* Export database to XML format.
* Import to database from XML backup file.
* Flexible user permissioning.
* Easy to implement, ONE-CLICK Installation package: 01 component (backend & frontend) + 02 plugin + 01 module.
* Express Install Tools in backend.
* One-Click upgrade to newer version.
* Translation Manager built-in.
---------------------------------------------------------------------------

Poc/Exploit:
~~~~~~~~~

http://127.0.0.1/[path]/index.php?option=com_foobla_suggestions&controller=[LFI]%00




+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++