FCKEditor 'FileUpload()'函数任意文件上传漏洞

BUGTRAQ ID: 56735 FCKeditor是一款开放源码的HTML文本编辑器。 FCKEditor 2.6.8及其他版本在'FileUpload'函数的实现上存在安全漏洞，攻击者可利用此漏洞上传任意文件到受影响计算机。 0 FCKeditor 2.6.8 厂商补丁： FCKeditor --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.fckeditor.net/...

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass

Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link: http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the extensions when FCKEditor 2.6.8 ASP version is dealing with the...

FCKEditor ASP Version 2.6.8 File Upload Protection Bypass

Exploit for asp platform in category web applications - Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the extensions when...

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass

FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass - Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass - Credit goes to: Mostafa Azizi, Soroush Dalili - Link: http://sourceforge.net/projects/fckeditor/files/FCKeditor/ - Description: There is no validation on the...

The latest FCKeditor proof absolute path vulnerability-vulnerability warning-the black bar safety net

Code: FCKeditor/editor/filemanager/connectors/asp/connector. asp? Command=CreateFolder&Type=File&CurrentFolder=%2F&NewFolderName=aux Version not test it. Principle: create an aux folder, aux in the windows system is not supported, so will complain, broke the absolute path, this relatively...

CKFinder 2.3 / FCKEditor 2.6.8 SWF Cross Site Scripting

Hello The latest versions of CKFinder 2.3 and FCKEditor2.6.8 are accepting SWF as a valid extension. As a result, it is possible to make a website vulnerable to an XSS attack by uploading a malicious SWF file. Source: http://soroush.secproject.com/blog/2012/11/xss-by-uploadingincluding-a-swf-file...

Joomla!/Mambo FCKeditor模块'Connector'本地文件包含漏洞

Bugtraq ID:55563 Mambo / Joomla是流行的内容管理系统。 Mambo / Joomla包含的fckeditor模块不正确过滤提交给'Connector'参数的数据，可通过目录遍历序列以WEB权限查看系统文件内容。 0 mambo /joomla fckeditor 厂商解决方案 目前没有详细解决方案提供： http://www.joomla.org/ http://www.mambo-foundation.com/...

Mambo / Joomla FCKEditor Local File Inclusion

mambo /joomla fckeditor lfi Vulnerability Exploit Title :mambo /joomla fckeditor lfi Vulnerability Google Dork: /mambots/editors/fckeditor/editor/filemanager/browser/default Author: BHG Security Center Home: http://cc.black-hg.org - http://greyh4t.com/cc/ Tested on: linux+apache Finders:Siavash...

CVE-2012-2066

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2066: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2066

CVE-2012-2066 is a cross-site scripting (XSS) vulnerability affecting Drupal contributed editor modules: FCKeditor 6.x-2.x before 6.x-2.3, CKEditor 6.x-1.x before 6.x-1.9, and CKEditor 7.x-1.x before 7.x-1.7. The issue allows remote authenticated users or remote attackers to inject arbitrary scri...

CVE-2012-2066

Cross-site scripting XSS vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal allows remote authenticated users or remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Wordocs Israel FCKeditor Shell Upload

---------------------------------------------------------------- Wordocs Israel FCKeditor Shell Upload Disclosure Vulnerabilities ---------------------------------------------------------------- Exploit Title: Wordocs Israel FCKeditor Shell Upload Disclosure Vulnerabilities Google Dork:...

Wordpress fckeditor Arbitrary File Upload Vulnerability

a bug in Wordpress fckeditor that allows to us to occur a File Upload Vulnerability on a Remote machin. Exploit Title : Wordpress fckeditor Arbitrary File Upload Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://wordpress.org Security Risk :...

IIS7. 5 parsing vulnerability that occurs in FCKeditor editor-vulnerability warning-the black bar safety net

http://www.xxx.com/fckeditor/editor/fckeditor.html ! Under the image Upload button jumped out of the upload page, browse--see the directory. Blank, not the former come through. Decisive attempt to direct the horse, and Type Error=a failure, built a asp directory only to think of it is iis7. 5 of...

FCKeditor exploit summary-vulnerability warning-the black bar safety net

Fckeditor exploit summary View Editor Version FCKeditor/whatsnew.html ------------------------------------------------------------- 2. Version 2.2 version Apache+linux environments in the upload files back plus a. Breakthrough! Test passed...

businesswiki 2.5rc3 - Persistent Cross-Site Scripting Arbitrary file upload

businesswiki 2.5rc3 - Persistent Cross-Site Scripting Arbitrary file upload !/usr/bin/python ''' Exploit Title: Stored XSS & Arbitrary File Upload Vulnerabilities in BusinessWiki. Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://onbusinesswiki.com/ Software Link:...

BusinessWiki 2.5RC3 Stored XSS & Arbitrary File Upload

Exploit for php platform in category web applications !/usr/bin/python ''' Exploit Title: Stored XSS & Arbitrary File Upload Vulnerabilities in BusinessWiki. Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://onbusinesswiki.com/ Software Link:...

businesswiki 2.5rc3 - Persistent Cross-Site Scripting / Arbitrary file upload

!/usr/bin/python ''' Exploit Title: Stored XSS & Arbitrary File Upload Vulnerabilities in BusinessWiki. Date: 23/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://onbusinesswiki.com/ Software Link: http://sourceforge.net/projects/businesswiki/files/ Version: 2.5RC3 Gr33Tz:...