CVE-2024-5736 PoC — Joomla! Admiror Frames 安全漏洞

Source

https://github.com/afine-com/CVE-2024-5736

Associated Vulnerability

Title:Joomla! Admiror Frames 安全漏洞 (CVE-2024-5736)
Description:Joomla!是一套使用在Joomla!内容管理系统中的论坛组件。 Joomla! Admiror Frames 5.0之前版本存在安全漏洞，该漏洞源于容易受到服务端请求伪造攻击，允许攻击者访问仅从本地主机可访问的本地文件或服务器页面。

Description

AdmirorFrames Joomla! Extension < 5.0 - Server-Side Request Forgery

Readme

# CVE-2024-5736
AdmirorFrames Joomla! Extension < 5.0 - Server-Side Request Forgery

## Timeline
- Vulnerability reported to vendor: 26.01.2024
- New fixed 5.0 version released: 06.06.2024
- Public disclosure: 28.06.2024

## Description

Server-Side Request Forgery in AdmirorFrames Joomla! Extension in `afGdStream.php` file which uses value of `$_GET['src_file']` variable directly as a parameter to `imagecreatefrompng` function. 

The vulnerability exists in `afGdStream.php` file:
```
if ($_GET['src_file'] == "")
    exit;

    $src_file = urldecode($_GET['src_file']);
    $bgcolor = $_GET['bgcolor'];
    $colorize = $_GET['colorize'];
    $ratio = $_GET['ratio'];

    // Create src_img
    if (preg_match("/png/i", $src_file))
    {
        @$src_img = imagecreatefrompng($src_file);
    }
```

This issue was caused by direct usage of `$_GET['src_file']` variable as a parameter to `imagecreatefrompng` function. This problem has been fixed in AdmirorFrames Joomla! Extension at version 5.0.

## Affected versions
< 5.0 

## Advisory
Update AdmirorFrames Joomla! Extension to version 5.0 or newer.

### References
* https://github.com/vasiljevski/admirorframes/issues/3
* https://cert.pl/en/posts/2024/06/CVE-2024-5735/
* https://cert.pl/posts/2024/06/CVE-2024-5735/
* https://nvd.nist.gov/vuln/detail/CVE-2024-5736

File Snapshot


 [4.0K]  /data/pocs/b527795011d9bdbc83644de3f82e5bcbcdb41f82
├── [ 34K]  LICENSE
└── [1.3K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!