eXtplorer standalone & Joomla!/Mambo Remote Code Execution vulnerability
Remote code execution in eXtplorer through local file inclusion and directory traversal in the lang parameter.
Antecedentes
eXtplorer is a web file manager with a desktop application interface (drag and drop, grid and directory tree), based on the ExtJS library. It is used to access server files and directories via FTP or direct access. It works as a component for Joomla! 1.5.x, 1.0.x and Mambo, or independently, and is based on Quixplorer.
Description
eXtplorer is vulnerable to local file inclusion and directory traversal because it does not sufficiently sanitize input: the lang parameter is not filtered. Since the application allows file uploads, an attacker can upload malicious PHP code, find the full path of the file (if display_errors is enabled), and include it using local file inclusion, thereby viewing any local file or executing arbitrary code in the context of the web server.
Business impact
An attacker could execute arbitrary code remotely and perhaps gain access to the server's operating system.
Affected systems
eXtplorer versions earlier than 2.0.0.
Solución
Update to eXtplorer version 2.0.1.
Calendario de divulgación
References
The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.
Company based in Spain and Colombia, specializing in web application auditing, network security, penetration testing, and compliance implementation and assessment. Our clients include some of the largest finance, telecommunications, insurance, and ICT companies. A vendor-independent provider with in-depth experience since 2001. Our R&D efforts include vulnerability research, collaboration on open security projects, whitepapers, and participation in industry events.
Would you like us to review your product?
Contact usDo you need a security audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Our offices
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)