Unscored CVE-2007-2630 EUVD-2007-2623GHSA-4329-9f98-hhhp

Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampa…

Published May 11, 2007 · Updated Aug 7, 2024 · Assigned by mitre

Description

Incomplete blacklist vulnerability in filemanager/browser/default/connectors/php/config.php in the FCKeditor module, as used in ActiveCampaign 1-2-All (aka 12All) 4.50 through 4.53.13, and possibly other products, allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files via unspecified vectors. NOTE: this issue is reachable through filemanager/browser/default/browser.html.

References

http://www.activecampaign.com/support/forum/showthread.php?t=3293
12all-fckeditor-file-upload(34049) vdb-entry
20070507 Re: 12All File Upload Vulnerability mailing-list
20070502 12All File Upload Vulnerability mailing-list
36161 vdb-entry
23792 vdb-entry