|
Description
|
|
Alfredo Arauz has discovered a vulnerability in the Simple Page Options module for Joomla!, which can be exploited by malicious people to disclose sensitive information.
Input passed via the "spo_site_lang" parameter to modules/mod_spo/email_sender.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
The vulnerability is confirmed in version 1.5.16. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
Simple Page Options 1.x (module for Joomla!)
|
|
|
|
|
|
Solution
|
|
Update to version 1.5.17.
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
Simple Page Options:
http://omar84.com/latest-news/65-simple-page-options-1517-security-release
Alfredo Arauz:
http://seguridadblanca.blogspot.com/2011/07/simple-page-option-lfi.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
