PT-2011-1853 · Joomla · Joomla!+1

Lost.Hacker · Published 2011-10-08 · Updated 2017-08-29 · CVE-2010-4918

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions iJoomla Magazine (com magazine) component version 3.0.1 for Joomla!

Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved by providing a URL in the config parameter to magazine.functions.php.

Recommendations For version 3.0.1, consider disabling access to magazine.functions.php until a patch is available to prevent exploitation. Restrict the use of the config parameter to minimize risk.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-4918

Affected Products

Joomla!

Ijoomla Magazine

References · 6

• 🔥 http://packetstormsecurity.org/1009-exploits/ijoomlamagazine-rfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/14896 · Exploit
• 🔥 http://exploit-db.com/exploits/14896 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-4918 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61598 · Note
• http://securityreason.com/securityalert/8451 · Note