"File Manager" Remote Shell and Deface Upload Vulnerability.

Following is the vulnerability to remotly upload your shell or deface on a vulnerable website.

Google Dorks:

inurl:/filemanager/userfiles/ filetype:pdf
inurl:/filemanager/index.html

Vulnerable URL:

http://www.site.com/filemanager/index.html

Now, google the dork and select any website from the search result.

When you will select any website, the URL will be as

http://www.site.com/filemanager/UserFiles/File/xyz/abc.pdf

Now delete the text after filemanager. Now after deleteing the text URL will be

http://www.site.com/filemanager/

You will get a upload option, upload your shell or deface there.

Your will will be uploaded in Userfiles directory. z

To view your shell visit the below mentioned URLs:

http://www.site.com/UserFiles/Shell.php

http://www.site.com/UserFiles/deface.html

or 

http://www.site.com/UserFiles/directory/Shell.php

http://www.site.com/UserFiles/directory/deface.html

"File Manager" Remote Shell and Deface Upload Vulnerability.

Following is the vulnerability to remotly upload your shell or deface on a vulnerable website.

Google Dorks:

inurl:/filemanager/userfiles/ filetype:pdf
inurl:/filemanager/index.html

Vulnerable URL:

http://www.site.com/filemanager/index.html

Now, google the dork and select any website from the search result.

When you will select any website, the URL will be as

http://www.site.com/filemanager/UserFiles/File/xyz/abc.pdf

Now delete the text after filemanager. Now after deleteing the text URL will be

http://www.site.com/filemanager/

You will get a upload option, upload your shell or deface there.

Your will will be uploaded in Userfiles directory. z

To view your shell visit the below mentioned URLs:

http://www.site.com/UserFiles/Shell.php

http://www.site.com/UserFiles/deface.html

or 

http://www.site.com/UserFiles/directory/Shell.php

http://www.site.com/UserFiles/directory/deface.html

HTML Editor File Upload Exploit

This is a exploit which can be used to upload .JPG and .TXT on the website
Dork: inurl:/HTMLEditor/editor/ 
         "inurl:/HTMLEditor/editor//filemanager/"
         "inurl:/HTMLEditor/editor//filemanager//connectors/"

Use any one above mentioned dork.

Vulnerable URL: http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html

                        http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html

Now under:

Select the "File Uploader" to use Change the type to PHP. Choose your file. Click on Send it to the Server to upload your file. If uploaded sucessfully, you will get a message saying "File uploaded without any error" After the uploading process. In the right hand side see the Uploaded File URL. From there see your uploded file :D Demo website:

http://www.gofastrchobbies.com/imagesupload/cms_files/Hacking%20Exposed.png

HTML Editor File Upload Exploit

This is a exploit which can be used to upload .JPG and .TXT on the website
Dork: inurl:/HTMLEditor/editor/ 
         "inurl:/HTMLEditor/editor//filemanager/"
         "inurl:/HTMLEditor/editor//filemanager//connectors/"

Use any one above mentioned dork.

Vulnerable URL: http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html

                        http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html

Now under:

Select the "File Uploader" to use Change the type to PHP. Choose your file. Click on Send it to the Server to upload your file. If uploaded sucessfully, you will get a message saying "File uploaded without any error" After the uploading process. In the right hand side see the Uploaded File URL. From there see your uploded file :D Demo website:

http://www.gofastrchobbies.com/imagesupload/cms_files/Hacking%20Exposed.png