Joomla Community Builder Enhenced Local File Include and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	43873
Class:	Input Validation Error
CVE:	CVE-2010-5280
Remote:	Yes
Local:	No
Published:	Oct 08 2010 12:00AM
Updated:	Nov 29 2012 12:40PM
Credit:	Delf Tonder
Vulnerable:
Not Vulnerable:

Joomla Community Builder Enhenced Local File Include and Arbitrary File Upload Vulnerabilities

Joomla Community Builder Enhenced is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to upload arbitrary files onto the application, execute arbitrary local files within the context of the affected application, and obtain sensitive information. By exploiting the arbitrary-file-upload and local file-include vulnerabilities at the same time, the attacker may be able to execute remote code.

Versions prior to Joomla Community Builder Enhenced 1.4.11 are vulnerable.

Joomla Community Builder Enhenced Local File Include and Arbitrary File Upload Vulnerabilities

An attacker can exploit these issues via a browser.

The following example URI is available:

http://www.example.com/index.php?option=com_cbe&task=userProfile&user=23&ajaxdirekt=true&tabname=../../../CREDITS.php%00

Joomla Community Builder Enhenced Local File Include and Arbitrary File Upload Vulnerabilities

Solution:
Vendor patch is available. Please see the reference for details.

Joomla Community Builder Enhenced Local File Include and Arbitrary File Upload Vulnerabilities

References:

• Joomla Community Builder Enhenced Homepage (Joomla)
  
• LFI / RCE vlunerability in Joomla Community Builder Enhenced (CBE) Component (Delf Tonder)