PT-2007-1846 · Joomla · Joomla!

Published 2007-01-19 · Updated 2018-10-16 · CVE-2007-0375

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Joomla! version 1.5.0 Beta

Description: The issue allows remote attackers to obtain sensitive information via direct requests for certain PHP scripts. This is related to a jimport function call at the beginning of each script, which reveals the path in various error messages. The affected scripts include "plugins/user/example.php", "gmail.php", "example.php", "ldap.php" in "plugins/authentication/", and "modules/mod mainmenu/menu.php".

Recommendations: For Joomla! version 1.5.0 Beta, consider restricting access to the specified PHP scripts, such as "example.php", "gmail.php", "ldap.php", and "menu.php", until a fix is available. As a temporary workaround, avoid using the jimport function call at the beginning of each script to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-0375

Affected Products

Joomla!

References · 10

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html · Exploit
• http://hackers.ir/advisories/festival.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0375 · Security Note
• http://osvdb.org/32524 · Note
• http://securityfocus.com/archive/1/459203/100/0/threaded · Note
• http://osvdb.org/32525 · Note
• http://osvdb.org/32522 · Note
• http://osvdb.org/32526 · Note
• http://osvdb.org/32523 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0375 · Note