Drupal Remote File Upload Vulnerability

1) Search this google dork:

Code:

inurl:"/imce?dir="
intitle:"File Browser"

2) Click on any link that its title is "File Browser" among with something else

so you will find Screen like this
[You must be registered and logged in to see this image.]

3) Click on the "Upload" button

4) Upload your Deface Page

5) Click the link in the box to View the URL ...

Old but still working. Thanks for sharing!