Joomla! Simple Page Options Module "spo_site_lang" Local File Inclusion Vulnerability

SECUNIA ADVISORY ID:
SA45334

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/45334/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=45334

RELEASE DATE:
2011-07-22

DESCRIPTION:
Alfredo Arauz has discovered a vulnerability in the Simple Page
Options module for Joomla!, which can be exploited by malicious
people to disclose sensitive information.

Input passed via the "spo_site_lang" parameter to
modules/mod_spo/email_sender.php is not properly verified before
being used to include files. This can be exploited to include
arbitrary files from local resources via directory traversal attacks
and URL-encoded NULL bytes.

The vulnerability is confirmed in version 1.5.16. Other versions may
also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY:
Alfredo Arauz

ORIGINAL ADVISORY:
http://seguridadblanca.blogspot.com/2011/07/simple-page-option-lfi.html