Description
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Joomla Media Manager File Upload Vulnerability
exploit/unix/webapp/joomla_media_upload_exec
Exploit-DB 1
- Joomla! Component Media Manager - Arbitrary File Upload (Metasploit) EDB-27610 · remote · Aug 15, 2013 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 27610 exploit
- http://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html
- http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31626
- VU#639620 third-party-advisory
- [oss-security] 20130824 Re: CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- https://github.com/joomla/joomla-cms/commit/1ed07e257a2c0794ba19e864f7c5101e7e8c41d2
- https://github.com/joomla/joomla-cms/commit/fa5645208eefd70f521cd2e4d53d5378622133d8
- [oss-security] 20130824 CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/