PT-2006-1714 · Ckeditor · Ckeditor

Blackhawk · Published 2006-02-13 · Updated 2017-10-11 · CVE-2006-0658

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FCKeditor versions 2.0 through 2.2

Description The issue allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt. This is due to an incomplete blacklist vulnerability in the connector.php file.

Recommendations For FCKeditor versions 2.0 through 2.2, consider updating the Config[DeniedExtensions][File] to include additional file extensions that could be used to execute arbitrary scripts, or restrict file uploads to prevent exploitation until a proper fix is available.

Exploit

Fix

Related Identifiers

CVE-2006-0658

Affected Products

Ckeditor

References · 8

• 🔥 https://exploit-db.com/exploits/3702 · Exploit
• 🔥 http://securityfocus.com/archive/1/424708 · Exploit
• 🔥 https://exploit-db.com/exploits/1484 · Exploit
• 🔥 http://retrogod.altervista.org/fckeditor_22_xpl.html · Exploit
• http://secunia.com/advisories/18767 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0658 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0658 · Note