FCKEditor File Upload Vulnerability

Description: There is no validation on the extensions when FCKEditor 2.6.8 ASP version is dealing with the duplicate files. As a result, it is possible to bypass the protection and upload a file with any extension. - Reference: http://www.exploit-db.com/exploits/23005/ vulnerable versions: prior...

FCKEditor 2.6.8 file upload and CKFinder/FCKEditor DoS vulnerability-vulnerability warning-the black bar safety net

Thanks to the endless in freebuf community”share the mission”to give a clue, only with this article Original post: http://club.freebuf.com/?/question/129reply12 FCKEditor 2.6.8 file upload vulnerability Exploit-db on the original as follows: - Title: FCKEditor 2.6.8 ASP Version File Upload...

The latest FCKEditor ASP upload bypass vulnerability-vulnerability warning-the black bar safety net

exploiut-db: FCKEditor ASP Version 2.6.8 File Upload Protection Bypass - Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link:http://sourceforge. net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on...

FCKEditor 'FileUpload()'function arbitrary file upload vulnerability-vulnerability warning-the black bar safety net

Vulnerability version: FCKeditor 2.6.8 Vulnerability description: BUGTRAQ ID: 5 6 7 3 5 FCKeditor is an open source HTML text editor. FCKEditor 2.6.8 and other versions in the'FileUpload'function implementation on the presence of security vulnerabilities, an attacker can exploit this vulnerabilit...

FCKEditor 'FileUpload()'函数任意文件上传漏洞

BUGTRAQ ID: 56735 FCKeditor是一款开放源码的HTML文本编辑器。 FCKEditor 2.6.8及其他版本在'FileUpload'函数的实现上存在安全漏洞，攻击者可利用此漏洞上传任意文件到受影响计算机。 0 FCKeditor 2.6.8 厂商补丁： FCKeditor --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.fckeditor.net/...

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass

Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link: http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the extensions when FCKEditor 2.6.8 ASP version is dealing with the...

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass - Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link: http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the...

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

Exploit for asp platform in category web applications - Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the extensions when...

The latest FCKeditor proof absolute path vulnerability-vulnerability warning-the black bar safety net

Code: FCKeditor/editor/filemanager/connectors/asp/connector. asp? Command=CreateFolder&Type=File&CurrentFolder=%2F&NewFolderName=aux Version not test it. Principle: create an aux folder, aux in the windows system is not supported, so will complain, broke the absolute path, this relatively...

CKFinder 2.3 / FCKEditor 2.6.8 SWF Cross Site Scripting

Hello The latest versions of CKFinder 2.3 and FCKEditor2.6.8 are accepting SWF as a valid extension. As a result, it is possible to make a website vulnerable to an XSS attack by uploading a malicious SWF file. Source: http://soroush.secproject.com/blog/2012/11/xss-by-uploadingincluding-a-swf-file...

Joomla!/Mambo FCKeditor模块'Connector'本地文件包含漏洞

Bugtraq ID:55563 Mambo / Joomla是流行的内容管理系统。 Mambo / Joomla包含的fckeditor模块不正确过滤提交给'Connector'参数的数据，可通过目录遍历序列以WEB权限查看系统文件内容。 0 mambo /joomla fckeditor 厂商解决方案 目前没有详细解决方案提供： http://www.joomla.org/ http://www.mambo-foundation.com/...

Mambo / Joomla FCKEditor Local File Inclusion

mambo /joomla fckeditor lfi Vulnerability Exploit Title :mambo /joomla fckeditor lfi Vulnerability Google Dork: /mambots/editors/fckeditor/editor/filemanager/browser/default Author: BHG Security Center Home: http://cc.black-hg.org - http://greyh4t.com/cc/ Tested on: linux+apache Finders:Siavash...

CVE-2012-2066

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2066

CVE-2012-2066 is a cross-site scripting (XSS) vulnerability affecting Drupal contributed editor modules: FCKeditor 6.x-2.x before 6.x-2.3, CKEditor 6.x-1.x before 6.x-1.9, and CKEditor 7.x-1.x before 7.x-1.7. The issue allows remote authenticated users or remote attackers to inject arbitrary scri...

CVE-2012-2066: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2066

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2066

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-3780

Name of the Vulnerable Software and Affected Versions Drupal FCKeditor module versions 6.x-2.x before 6.x-2.3 Drupal CKEditor module versions 6.x-1.x before 6.x-1.9 Drupal CKEditor module versions 7.x-1.x before 7.x-1.7 Description A cross-site scripting XSS issue allows remote authenticated user...

Wordocs Israel FCKeditor Shell Upload

---------------------------------------------------------------- Wordocs Israel FCKeditor Shell Upload Disclosure Vulnerabilities ---------------------------------------------------------------- Exploit Title: Wordocs Israel FCKeditor Shell Upload Disclosure Vulnerabilities Google Dork:...