PT-2007-3949 · Fredck+1 · Ckeditor+1

Published 2007-05-11 · Updated 2018-10-16 · CVE-2007-2630

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ActiveCampaign 1-2-All (aka 12All) versions 4.50 through 4.53.13

Description The issue is related to an incomplete blacklist vulnerability in the FCKeditor module, specifically in the filemanager/browser/default/connectors/php/config.php file. This allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files. The vulnerability can be reached through the filemanager/browser/default/browser.html file.

Recommendations For ActiveCampaign 1-2-All (aka 12All) versions 4.50 through 4.53.13, consider restricting access to the filemanager/browser/default/connectors/php/config.php file and the filemanager/browser/default/browser.html file to prevent potential exploitation. As a temporary workaround, consider disabling the upload functionality for .php4 and .php5 files in the FCKeditor module until a patch is available.

Fix

Related Identifiers

CVE-2007-2630

Affected Products

Activecampaign

Ckeditor

References · 8

• http://activecampaign.com/support/forum/showthread.php?t=3293 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-2630 · Security Note
• https://osv.dev/vulnerability/CVE-2007-2630 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34049 · Note
• http://securityfocus.com/bid/23792 · Note
• http://securityfocus.com/archive/1/467483/100/0/threaded · Note
• http://osvdb.org/36161 · Note
• http://securityfocus.com/archive/1/467879/100/0/threaded · Note