Description
connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PHP by using the FileUpload command to upload a file that appears to be an image but contains PHP script.
References
- ADV-2005-2771 vdb-entry
- docebolms-connector-file-upload(23519) vdb-entry
- 17896 third-party-advisory
- 15744 vdb-entry
- http://rgod.altervista.org/docebo204_xpl.html
- 21465 vdb-entry
- 1015308 third-party-advisory
- 1015308 vdb-entry