===================================================
            Joomla Real Estate Component Upload Vulnerability
            ===================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Joomla Real Estate Component Upload Vulnerability
Date : june, 19 2010
Vendor url :http://www.eaimproved.eu/
Critical Level     : HIGH 
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Real Estate Component with Frond-end administration, Front-end templating, Print and PDF page feature, RSS Feed, Flexible search for any 

language, Easy edit objects via front-end (similar to joomla content), Gallery with mov mp4 mpeg swf streaming media support, contact form 

and mail to friend from with security code (Captcha's), Support translation through backend AND front end using joomfish. Full GoogleMaps 

support with automatic (geocoded) or manual coordinates insertion, separately for each object.

#######################################################################################################
Real Estate Component suffers from Upload Vulnerability

Xploit:Upload Vulnerability


Step 1: register as a user :P

Step 2: post your property in "my property" option. with your shell code.. 

Step 3: Publish it and chk your posted property which contains the evil script ;) 


###############################################################################################################
# 0day no more 
# Sid3^effects