Joomla AjaxChat Component File Inclusion Vulnerability

SECUNIA ADVISORY ID:
SA37087

VERIFY ADVISORY:
http://secunia.com/advisories/37087/

DESCRIPTION:
kaMtiEz has reported a vulnerability in the AjaxChat component for
Joomla, which can be exploited by malicious people to compromise a
vulnerable system.

Input passed to the "mosConfig_absolute_path" parameter in
/components/com_ajaxchat/tests/ajcuser.php is not properly verified
before being used to include files. This can be exploited to include
arbitrary files from local or external resources.

SOLUTION:
Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY:
kaMtiEz

ORIGINAL ADVISORY:
http://packetstormsecurity.org/0910-exploits/joomlaajaxchat-rfi.txt