Joomla Dada Mail Manager Component "mosConfig_absolute_path" File Inclusion

SECUNIA ADVISORY ID:
SA32551

VERIFY ADVISORY:
http://secunia.com/advisories/32551/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Dada Mail Manager 2.x (component for Joomla)
http://secunia.com/advisories/product/20413/

DESCRIPTION:
NoGe has discovered a vulnerability in the Dada Mail Manager
component for Joomla, which can be exploited by malicious people to
compromise a vulnerable system.

Input passed to the "mosConfig_absolute_path" parameter in
administrator/components/com_dadamail/config.dadamail.php is not
properly verified before being used to include files. This can be
exploited to include arbitrary files from local or external
resources.

This vulnerability is confirmed in Dada Mail Manager version 2.6.
Other versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY:
NoGe

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/7002