46 lines
No EOL
1.1 KiB
Text
46 lines
No EOL
1.1 KiB
Text
########################################################################
|
|
#
|
|
# S4rK3VT Hacking TEAM
|
|
#
|
|
# Title: KimWebsite (fckeditor) Remote Arbitrary File Upload
|
|
# Vendor: http://sourceforge.net/project/showfiles.php?group_id=196819
|
|
# discover by : Ciph3r
|
|
# We Are : Ciph3r & Rake
|
|
# Ciph3r_blackhat@yahoo.com
|
|
# Impact: Medium
|
|
# Fix: N/A
|
|
# Expl0ters Security TEAM ==>> www.Expl0iters.ir
|
|
########################################################################
|
|
|
|
####################
|
|
- Vulnerability:
|
|
####################
|
|
|
|
+--> Fckeditor Arbitrary File Upload
|
|
|
|
The problem is that it is possible to upload files to a location inside the web root "/userdata" via the
|
|
|
|
[path]/fck/editor/filemanager/upload/php/upload.php script.
|
|
|
|
|
|
####################
|
|
- Exploit:
|
|
####################
|
|
|
|
http://example.com/[path]/fck/editor/filemanager/upload/test.html
|
|
|
|
####################
|
|
- Solution:
|
|
####################
|
|
|
|
Restrict and grant only trusted users access to the resources.
|
|
|
|
####################
|
|
- GreTzZ :
|
|
####################
|
|
|
|
Iranian Hacker & Kurdish Security TEAM & My Mother
|
|
|
|
####################
|
|
|
|
# milw0rm.com [2008-09-09] |