CVE-2010-2918

NUCLEI

Visites 1.1 RC2 - RCE

Title source: llm

Description

PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Li0n-PaL · textwebappsphp

https://www.exploit-db.com/exploits/14476

View Code ZIP pw:eip

exploitdb WRITEUP VERIFIED

by NoGe · textwebappsphp

https://www.exploit-db.com/exploits/31708

View Code ZIP pw:eip

Nuclei Templates (1)

Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion

HIGHby daffainfo

References (5)

[Exploit] http://packetstormsecurity.org/0804-exploits/joomlavisites-rfi.txt

[Exploit] http://www.exploit-db.com/exploits/14476

[Exploit] http://www.securityfocus.com/bid/28942

[Vendor Advisory] http://www.vupen.com/english/advisories/2010/1925

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/42025

Scores

EPSS 0.0160

EPSS Percentile 81.8%

Details

CWE

CWE-94

Status published

Products (1)

visocrea/com_joomla_visites 1.1 rc2

Published Jul 30, 2010

Tracked Since Feb 18, 2026