Description
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- SyntaxCMS 1.3 - 'FCKeditor' Arbitrary File Upload EDB-5688 · webapps · May 29, 2008 · verified
- Lanius CMS 1.2.16 - 'FCKeditor' Arbitrary File Upload EDB-5618 · webapps · May 14, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 30677 vdb-entry
- http://sourceforge.net/forum/forum.php?forum_id=743930
- http://dev.fckeditor.net/ticket/1325
- 5688 exploit
- http://www.waraxe.us/advisory-57.html
- 29422 vdb-entry
- syntaxcms-upload-file-upload(42733) vdb-entry
- 5618 exploit
- cardinal-upload-file-upload(44455) vdb-entry
- lanai-upload-file-upload(42425) vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=546000
- 27123 third-party-advisory
- 3182 third-party-advisory
- http://dev.fckeditor.net/changeset/973
- 20070927 [waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS mailing-list
- 27174 third-party-advisory
- ADV-2007-3464 vdb-entry
- ADV-2007-3465 vdb-entry
- http://downloads.securityfocus.com/vulnerabilities/exploits/30677.php