Joomla! Component com_oziogallery2 / IMAGIN – Arbitrary File Write

• Exploit Database
• 130 阅读

• 作者： Ubik & er
  日期： 2010-01-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/10979/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

  # Exploit Title: Joomla component com_oziogallery2 / IMAGIN arbitrary file write # Date: 01-01-10 # Author: Ubik and er # Software Link: oziogallery.joomla.it / imagin.ro # Version: all # Disclaimer : all the information in this document is provided "as is", for educational purposes only. The authors will not be responsible for any damage.   technical information --------------------- We can find this obviously flawed code in /scripts_ralcr/filesystem/writeToFile.php:   ************************* $file = "../../".$_POST["path"];   $fh = fopen ($file, 'w') or die("error::Can't open file for writing"); echo fwrite ($fh, stripslashes($_POST["raw_data"]));   fclose($fh); *************************   An attack can be easily performed by manipulating the parameters (path and raw_data). Probably other php files in scripts_ralcr are coded without any care about security. In Oziogallery the vulnerable files are located in /components/com_oziogallery2/imagin/scripts_ralcr/.