source: http://www.securityfocus.com/bid/58313/info File Manager is prone to an HTML-injection vulnerability and a local file-include vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, steal cookie-based authentication credentials and open or run arbitrary files in the context of the web server process. Other attacks are also possible. File Manager 1.2 is vulnerable; other versions may also be affected. Local file-include:
Files

..
1234.png.txt.iso.php.asp ( 95.8 Kb, 2013-02-11 07:41:12 +0000)
[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE VULNERABILITY]] ( 27.3 Kb, 2013-02-11 07:45:01 +0000)
About/ ( 0.1 Kb, 2012-10-10 18:20:14 +0000)

upload file
HTML-injection :
Files

..
[PERSISTENT INJECTED SCRIPT CODE!].png.txt.iso.php.asp ( 95.8 Kb, 2013-02-11 07:41:12 +0000)
[PERSISTENT INJECTED SCRIPT CODE!] ( 27.3 Kb, 2013-02-11 07:45:01 +0000)
About/ ( 0.1 Kb, 2012-10-10 18:20:14 +0000)

upload file