Joomla com_annonces Upload Shell

2017.08.20
Credit: Dyar Sahdi
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

================================================= Name : Joomla com_eportfolio Upload Vulnerability Vendor Url : http://www.joomplace.com/e-portfolio/e-portfolio-description.html Google Dork:inurl:com_eportfolio Author : Dyar Sahdi ==================================================== ####################################################################################################### Description: Advanced access control will let a user decide who will be able to read and comment his joomla portfolio. There are many configuration features like the ability to upload files to portfolio, calendar and events by users and others. Who can use E-portfolio? * professionals wanting to have their own advanced blog with features such as forum and calendar * people looking for job to list their CV's * students and graduates having their portfolio ONLINE to be visible for teachers, parents, CEOs, etc. * anyone who wants the worls to know who they are, what they do and have already done! ############################################################################################################### =================================================== Xploit:Upload Vulnerability STEP 1: Always register as a user :P STEP 2: Select any of the options Achievements • Plans • Events • Pages. DEMO URL :http://server/index.php?option=com_eportfolio&Itemid=1&task=viewlinks&user=71 STEP 3: Now the attackers can upload their shells in the above options :) DEMO URL : http://server/index.php?option=com_eportfolio&Itemid=18&task=personal&user=71 STEP 4: Now you can check your shell n root the server :P ==================================================================


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top