SNS Vulnerability

Agora for Joomla "action" Parameter Local File Inclusion Vulnerability

Description

A vulnerability has been identified in Agora (component for Joomla), which could be exploited by attackers to gain knowledge of sensitive information. This issue is caused by an input validation error when processing the "action" parameter while "task" is set to "profile" and "page" is set to "avatars", which could be exploited by attackers to include or disclose the contents of local files with the privileges of the web server.

Vulnerable Products

Vulnerable Software:
Agora (component for Joomla) version 3.0.0b and prior

Solution

CVE

CVE-2009-3053

References

http://milw0rm.com/exploits/9564

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
Misc : Directory traversal - parameter starting with ../	3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL	3.2.0
Directory traversal using ..\..	3.2.0
Directory traversal	3.2.0
Directory traversal backward root folder	3.2.0
Misc : Local File Inclusion - suspicious /etc/passwd found in URL	3.5.0

Risk level

Moderate

Vulnerability First Public Report Date

2009-09-02

Target Type

Server

Possible exploit

Local & Remote