Noah's Classifieds Local File Include Vulnerability

Bugtraq ID:	16778
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 22 2006 12:00AM
Updated:	Mar 06 2006 06:26AM
Credit:	trueend5 is credited with the discovery of this vulnerability.
Vulnerable:	PhpOutsourcing Noah's Classifieds 1.3 Joomla Noah Classifieds 1.0.Beta2 Joomla Noah Classifieds 1.0.Beta1
Not Vulnerable:	Joomla Noah Classifieds 1.0.beta3

Noah's Classifieds Local File Include Vulnerability

Noah's Classifieds is prone to a local file-include vulnerability. This may facilitate the unauthorized viewing of files and unauthorized execution of local scripts.

Version 1.3.0 is vulnerable; other versions may be affected as well.

Noah's Classifieds Local File Include Vulnerability


No exploit is required.

An example has been provided:

http://www.example.com/classifieds/index.php?otherTemplate=/../../../etc/passwd%00http://www.example.com/classifieds/index.php?otherTemplate=/../../../etc/passwd%00

Noah's Classifieds Local File Include Vulnerability

Solution:

Joomla has released some updates to address this for the Joomla Noah component. See the reference section for further information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Noah's Classifieds Local File Include Vulnerability

References:

• Noah's Classifieds Web Site (Noah's Classifieds)
  
• [KAPDA::#29]Noah's classifieds multiple vulnerabilities (alireza hassani )
  
• Updated Noah Classifieds Component for Joomla!/Mambo ([email protected])