Flax Article Manager 1.1 - Remote PHP Script Upload Vulnerability

ID EDB-ID:7884
Type exploitdb
Reporter S.W.A.T.
Modified 2009-01-27T00:00:00


Flax Article Manager 1.1 Remote PHP Script Upload Vulnerability. Webapps exploit for php platform

                                            [~] Flax Article Manager 1.1 Remote File Upload Vulnerability
[~] ----------------------------------------------------------
[~] Discovered By: S.W.A.T.   svvateam@yahoo.com
[~] Home: www.batlagh.com
[~] Script Page: http://www.clixint.com/products/articles
[~] Dork: Copyright 2006 © Flax Article Manager v1.1
[~] -----------------------------------------------------------


1.First Register Into The Site ( link: www.site.com/[path]/register.php )

2.Login With Your Username & Password

3.Choose A Picture For Your Avatar You Can Use All Extention File Ex: c99.php
[In Edit Profile] Or [Register Page] You Can Select The File

4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/images/author_pics/[random id]_avatar.php )

5.Go To This Url: www.site.com/[path]/profile.php?author_id=[Your Author ID] Then Right Click On The Pic And Use Properties To Find Out The Link Of Shell Script

6.Hack The Site ;)



[~] Me:

I'll Be  A C I D A L !!!

# milw0rm.com [2009-01-27]