Joomla Service Upload Vulnerability

vendor:

Upload Script

by:

M0r0Can

8,8

CVSS

HIGH

Remote File Upload

434

CWE

Product Name: Upload Script

Affected Version From: 1.09

Affected Version To: 1.09

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Joomla Service Upload Vulnerability

A vulnerability in the Joomla Service Upload script allows an attacker to upload malicious files to the server. The attacker can upload a malicious file with a double extension such as ‘evil.php.jpg’ and access it via the URL http://[site]/img/evil.php.jpg. This allows the attacker to execute arbitrary code on the server.

Mitigation:

The vendor should ensure that the application validates the file type before allowing it to be uploaded.

Source

Exploit-DB raw data:

[~]######################################### InformatioN
#############################################[~]
[~] Homepage: http://www.joomlaservice.info Or http://www.dz4all.com
[~] Vendor : http://www.php-space.info/bilder-upload-script/
[~] Download:
http://www.php-space.info/bilder-upload-script/bilder-upload-script_1.09.rar
[~] Email : MaFiadu48@hotmail.fr
[~] Dork : allinurl: In YoUr Dream Lamerz

######################################################################################################

{exploit} : http://127.0.0.1/upload.php

Upload Your Evil script evil.php.jpg
or user temper data
image/jpeg
filename="evil.php.jpg
filename="evil.php
and upload

After you have uploaded your shells , you will find it in this Path :
http://[site]/img/evil.php.jpg

######################################################################################################


Greetz To : Federal7-blackroot-khalidmoro-ra3ch-yesmouh-Zi00n From
Ukrania-Dr.Prorat anti Tr4ck3r Anas
yotim Skiiozarsse Besel vip t4m3r all My Friend

and al muslim h4x0r

M0r0Can Is Here

--=-=-=-=-www.Joomlaservice.info or www.dz4all.com -=-=-=-=--=