kimwebsites-upload.txt

`########################################################################  
#  
# S4rK3VT Hacking TEAM  
#  
# Title: KimWebsite (fckeditor) Remote Arbitrary File Upload  
# Vendor: http://sourceforge.net/project/showfiles.php?group_id=196819  
# discover by : Ciph3r  
# We Are : Ciph3r & Rake  
# [email protected]  
# Impact: Medium  
# Fix: N/A  
# Expl0ters Security TEAM ==>> www.Expl0iters.ir  
########################################################################  
  
####################  
- Vulnerability:  
####################  
  
+--> Fckeditor Arbitrary File Upload  
  
The problem is that it is possible to upload files to a location inside the web root "/userdata" via the  
  
[path]/fck/editor/filemanager/upload/php/upload.php script.  
  
  
####################  
- Exploit:  
####################  
  
http://example.com/[path]/fck/editor/filemanager/upload/test.html  
  
####################  
- Solution:  
####################  
  
Restrict and grant only trusted users access to the resources.  
  
####################  
- GreTzZ :  
####################  
  
Iranian Hacker & Kurdish Security TEAM & My Mother  
  
####################  
  
`