[*]############################################## [+] |____ViRuS_HiMa@YouR SyS__|__\ # [+] |______________________|___||\*___ # [+] |______________________|___||""|"*\___, # [+] |______________________|___||""|*"|___|| # [+] "([ (@)''(@)""""""(|*(@)(@)********(@)* # [+]======================================================================|| [*] Title : FotoFlexer Remote File Upload Vulnerability || [!] site script : http://www.fotoflexer.com || [!] Author : ViRuS_HiMa || [!] My Site : wWw.HeLL-z0ne.org || [!] E-Mail : eGypT_GoVeRnMenT[at]HoTmaiL[dot]CoM || [!] Location : Cairo-007 || [!]======================================================================|| [!] [H]eL[L] [Z]on[E] [C]re[W] - [ ViRuS_HiMa ~ MecTruy ~ RedStorM ] || [!]======================================================================|| [!] Exploitation : [!] [!] Fotoflexer is A online images editor script . . [!] [!] it's allow you to upload 2 types of images : png & jpg [!] [!] So you can upload your file as hima.php.jpg 'or' hima.php.png [!] [!] but how to get your file link after uploading ?? [!] [!] here we got alive e.g on : http://tahyeess.com/fotoflexer/default.aspx [!] [!] after uploading your file you will redirect to this link : [!] [!] http://tahyeess.com/fotoflexer/API_Loader.aspx?ff_image_url= [!] http://www.tahyeess.com/OriginalFiles/fotoflexer/hima.php.jpg [!] &ff_callback_url=http://www.tahyeess.com/fotoflexer/callbackTest.aspx [!] &ff_logo_url=http://www.tahyeess.com/fotoflexer/images/logo.png [!] [!] yea its too long url but you can find your file link in it ! take look over here : [!] [!] "ff_image_url=http://www.tahyeess.com/OriginalFiles/fotoflexer/hima.php.jpg" [!] [!] Thats all we need :) [!] [!] now you should browse it from InternetExplorer :) [!] [!]===============================================================|| [!] do you want to try it on http://www.fotoflexer.com :) || [!] just use this html code to upload your file || [!] and you will find your link by the same method on tahyeess.com|| [!] but your file link will be some thing like this : || [!] ff_image_url=http://fotos.fotoflexer.com/2009/07/13/adf487e0 || [!]===============================================================|| FotoFlexer - exploitation testing :)

Back to FotoFlexer API

FotoFlexer - Exploitation Testing :)

this code was already writen by fotoflexer team and edited by ViRuS_HiMa to be decent .

[H]eL[L] [Z]on[E] [C]re[W] - [ ViRuS_HiMa ~ MecTruy ~ RedStorM ]

Click An Image To Edit:

Or, Upload An Image To Edit:


[*]===================================================================|| [!] Greetz 2 Allah - Muslim Hackers - Str0ke - And oTherz . || [*]===================================================================||