Joomla Component com_articleman Upload Vulnerability
Posted on 08 May 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Joomla Component com_articleman Upload Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==================================================== Joomla Component com_articleman Upload Vulnerability ==================================================== Description : Article Factory Manager is a very useful tool for any article driven sites. As the title inspires its an article manager with various features, like management of the articles, edit, delete, publish, etc. It also providing a new Approval System, much more simplified then the one present in the Joomla core. The approval workflow (including email notifications) provides a series of features which are very important for a daily usuage like: view my articles, view pending articles, view article rejection reason, etc. This workflow includes also for the administrator a very easy and fast frontend approval system. Administrators can set allowed html TAGS, number of links per article, word count restriction, etc. A Resource Box its provided for the author in order to make the publishing process faster. Article Manager also includes a Notifiy System where the administrator receive an mail each time an article is pending for approval and the author upon publication. ############################################################################ Xploit : Upload Vulnerability STEP 1 : Register first :) STEP 2 : Goto "Submit new article"option. STEP 3 : The attacker either upload a shell in the article section and your shell gets executed :P DEMO URL : To submit your evil article :D http://server/index.php?option=com_articleman&task=new Once uploaded you can check your article :P ############################################################################ #Sid3^effects # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-05-08]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
