- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 6410
- Проверка EDB
-
- Пройдено
- Автор
- CIPH3R
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- N/A
- Дата публикации
- 2008-09-09
Код:
########################################################################
#
# S4rK3VT Hacking TEAM
#
# Title: KimWebsite (fckeditor) Remote Arbitrary File Upload
# Vendor: http://sourceforge.net/project/showfiles.php?group_id=196819
# discover by : Ciph3r
# We Are : Ciph3r & Rake
# [email protected]
# Impact: Medium
# Fix: N/A
# Expl0ters Security TEAM ==>> www.Expl0iters.ir
########################################################################
####################
- Vulnerability:
####################
+--> Fckeditor Arbitrary File Upload
The problem is that it is possible to upload files to a location inside the web root "/userdata" via the
[path]/fck/editor/filemanager/upload/php/upload.php script.
####################
- Exploit:
####################
http://example.com/[path]/fck/editor/filemanager/upload/test.html
####################
- Solution:
####################
Restrict and grant only trusted users access to the resources.
####################
- GreTzZ :
####################
Iranian Hacker & Kurdish Security TEAM & My Mother
####################
# milw0rm.com [2008-09-09]- Источник
- www.exploit-db.com
