title: CVE-2010-1602 Exploitation Attempt
id: f042c30f-ec39-4d1f-bc8b-56c94cd870a7
author: Subhash Popuri (@pbssubhash)
date: 2021/08/25
status: experimental
description: Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion:Directory
  traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for
  Joomla! allows remote attackers to read arbitrary files and possibly have unspecified
  other impact via a .. (dot dot) in the controller parameter to index.php.
references:
  - https://github.com/projectdiscovery/nuclei-templates
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - /index.php?option=com_zimbcomment&controller=../../../../../../../../../../etc/passwd%00
  condition: selection
false_positives:
  - Scanning from Nuclei
  - Penetration Testing Activity
  - Unknown
tags:
  - attack.initial_access
  - attack.t1190
level: critical