CVE-2010-2857
Description
Directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the cid parameter to album.html.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Joomla! Component Music Manager - Local File Inclusion
Critical Level : HIGH
Vendor Url : http://danieljamesscott.org/software/4-joomla-extensions/4-music-manager.html
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
########################################################
# I'm SiD3^effects member from Inj3ct0r Team #
# Support e-mail : submit[at]inj3ct0r.com #
########################################################
Description
Music Manager is an extension for Joomla! 1.5 which allows management of a music collection. It is easy to use and very flexible. Users can manage their music collection by artist, album and song. This component provides users with the ability to manage their music collection in a flexible and professional manner.
Begin by adding an entry to the 'Artists' table. This can be just yourself, if you are building your own music website, or every artist on the planet if you're building a music library. Then, add albums and fill in the name, description and creation year. Album art can be added to the images/albumart directory using the media manager and will then appear in the select-list on the album page. Finally, add songs to each album, upload mp3s to the images/songs directory and select them from the drop-down list.
######################################################################################################
Xploit :LFI Vulnerability
Demo Url :http://server/component/music/album.html?cid=[LFI]%00
#######################################################################################################
# 0day no more
# Sid3^effects Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| danieljamesscott | com_music | 0.1 | |
| danieljamesscott | com_music | 0.2 | |
| danieljamesscott | com_music | 0.3 | |
| danieljamesscott | com_music | 0.4 | |
| danieljamesscott | com_music | 0.5 | |
| danieljamesscott | com_music | 0.6 | |
| danieljamesscott | com_music | 0.7 | |
| danieljamesscott | com_music | 0.8 | |
| danieljamesscott | com_music | 0.9 | |
| danieljamesscott | com_music | 0.10 | |
| danieljamesscott | com_music | 0.11 | |
| danieljamesscott | com_music | 0.12 | |
References
- http://packetstormsecurity.org/1007-exploits/joomlamusicmanager-lfi.txt
- http://www.exploit-db.com/exploits/14274
- http://www.securityfocus.com/bid/41485
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60195
- http://packetstormsecurity.org/1007-exploits/joomlamusicmanager-lfi.txt
- http://www.exploit-db.com/exploits/14274
- http://www.securityfocus.com/bid/41485
- https://exchange.xforce.ibmcloud.com/vulnerabilities/60195
CWEs
CWE-22
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.