PT-2005-4826 · Fredck+1 · Ckeditor+1

Publicado 2005-12-08 · Atualizado 2017-07-20 · CVE-2005-4094

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DoceboLMS version 2.0.4

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file that appears to be an image but contains PHP script using the FileUpload command in the connector.php file of the fckeditor2rc2 addon.

Recommendations For DoceboLMS version 2.0.4, consider disabling the FileUpload command in the connector.php file of the fckeditor2rc2 addon until a patch is available. Restrict access to the connector.php file to minimize the risk of exploitation. Avoid using the FileUpload command to upload files that could potentially contain PHP script.

Exploit

Correção

Identificadores relacionados

CVE-2005-4094

Produtos afetados

Docebolms

Ckeditor

Referências · 10

• 🔥 http://securityfocus.com/bid/15744 · Exploit
• 🔥 http://rgod.altervista.org/docebo204_xpl.html · Exploit
• 🔥 http://secunia.com/advisories/17896 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4094 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4094 · Nota
• http://securitytracker.com/id?1015308 · Nota
• http://osvdb.org/21465 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23519 · Nota
• http://secunia.com/advisories/1015308 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2771 · Nota