PT-2005-4826 · Fredck+1 · Ckeditor+1

Published 2005-12-08 · Updated 2017-07-20 · CVE-2005-4094

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DoceboLMS version 2.0.4

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file that appears to be an image but contains PHP script using the FileUpload command in the connector.php file of the fckeditor2rc2 addon.

Recommendations For DoceboLMS version 2.0.4, consider disabling the FileUpload command in the connector.php file of the fckeditor2rc2 addon until a patch is available. Restrict access to the connector.php file to minimize the risk of exploitation. Avoid using the FileUpload command to upload files that could potentially contain PHP script.

Exploit

Fix

Related Identifiers

CVE-2005-4094

Affected Products

Docebolms

Ckeditor

References · 10

• 🔥 http://securityfocus.com/bid/15744 · Exploit
• 🔥 http://rgod.altervista.org/docebo204_xpl.html · Exploit
• 🔥 http://secunia.com/advisories/17896 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4094 · Security Note
• http://secunia.com/advisories/1015308 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4094 · Note
• http://securitytracker.com/id?1015308 · Note
• http://osvdb.org/21465 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23519 · Note
• http://vupen.com/english/advisories/2005/2771 · Note