CVE-2010-2122

NUCLEI

com_simpledownload < 0.9.6 - Path Traversal via Controller Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-2122. PoCs published by Xr0b0t, ALTBTA. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the Joomla component simpledownload. The PoC shows how to traverse directories and include arbitrary files (e.g., /etc/passwd) via the 'controller' parameter.

Description

Directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Xr0b0t · textwebappsphp
https://www.exploit-db.com/exploits/12618

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the Joomla component simpledownload. The PoC shows how to traverse directories and include arbitrary files (e.g., /etc/passwd) via the 'controller' parameter.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Joomla simpledownload component 0.9.5 (and possibly lower versions)
No auth needed
Prerequisites: Joomla with vulnerable simpledownload component installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by ALTBTA · textwebappsphp
https://www.exploit-db.com/exploits/12623

This exploit demonstrates a remote file disclosure vulnerability in the Joomla component simpledownload. By manipulating the 'fileid' parameter, an attacker can access arbitrary files on the server, such as 'configuration.php'.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Joomla simpledownload component version 0.9.5 (and possibly lower)
No auth needed
Prerequisites: Joomla installation with the vulnerable simpledownload component
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval
MEDIUMby daffainfo

References (8)

Core 8
Core References
Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/64743
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58625
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39871
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/12618
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/40192
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/511305/100/0/threaded

Scores

EPSS 0.0344
EPSS Percentile 87.8%

Details

CWE
CWE-22
Status published
Products (1)
joelrowley/com_simpledownload 0.9.5
Published Jun 01, 2010
Tracked Since Feb 18, 2026