PT-2006-1714 · Ckeditor · Ckeditor

Blackhawk · Publicado 2006-02-13 · Atualizado 2017-10-11 · CVE-2006-0658

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FCKeditor versions 2.0 through 2.2

Description The issue allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt. This is due to an incomplete blacklist vulnerability in the connector.php file.

Recommendations For FCKeditor versions 2.0 through 2.2, consider updating the Config[DeniedExtensions][File] to include additional file extensions that could be used to execute arbitrary scripts, or restrict file uploads to prevent exploitation until a proper fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-0658

Produtos afetados

Ckeditor

Referências · 8

• 🔥 https://exploit-db.com/exploits/3702 · Exploit
• 🔥 http://securityfocus.com/archive/1/424708 · Exploit
• 🔥 https://exploit-db.com/exploits/1484 · Exploit
• 🔥 http://retrogod.altervista.org/fckeditor_22_xpl.html · Exploit
• http://secunia.com/advisories/18767 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/0502 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0658 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0658 · Nota