Thursday, 30 September 2010 17:05

There is a file upload vulnerability in version 1.8.8 and earlier of JomSocial, the popular community extension for Joomla!.

Successful exploitation of this exploit requires the site to be configured to allow users to upload video files directly, which is disabled by default. If this feature is enabled, any file uploaded via the "add video" upload form will end up in http://[victim]/images/originalvideos/[your account's user id]/[unique file name]. This folder is not protected with an index, so if indexes are allowed retrieving the shell's filename is trivial.

Listed on the JomSocial Changelog as "BUG: 4495"

Timeline

  • Vulnerabilities Discovered: 26 September 2010
  • Vendor Notified: 27 September 2010
  • Vendor Response: 27 September 2010
  • Update Available: 28 September 2010
  • Disclosure: 30 September 2010
Last Updated on Thursday, 30 September 2010 17:43
 
Comments (1)
1 Sunday, 03 October 2010 02:44
falkon
bilmem thanks

Add your comment

Your name:
Comment:
  The word for verification. Lowercase letters only with no spaces.
Word verification:

The Joomla!® name is used under a limited license from Open Source Matters in the United States and other countries. Jeff Channell is not affiliated with or endorsed by Open Source Matters or the Joomla!® Project.

Santorum
Joomla Extensions