Joomla HD FLV Player + Upload + Shell + Deface

Exploit Title :  Joomla HD FLV Player <= 2.1.0.1 Arbitrary File Download Vulnerability
Exploit Author : Claudio Viviani
Vendor Homepage : http://www.hdflvplayer.net/
Software Link : http://www.hdflvplayer.net/hd-flv-player-download.php

Dork google 1:  inurl:/component/hdflvplayer/
Dork google 2:  inurl:com_hdflvplayer    

Date : 2014-11-11
Tested on : BackBox 3.x/4.x

Bom pessoal a falha afeta o componente hdflyvplayer, onde podemos adiquiro o arquivo de configuração do banco de dados com o servidor, assim podendo ter acesso aos usuario do site e subistituindo as senhas.



Video Demo;

Joomla HD FLV Player + Upload + Shell + Deface from Mathew Thomas on Vimeo.