SweetRice < 0.6.4 (fckeditor) Remote File Upload

🗓️ 01 Jul 2014 00:00:00Reported by RootType

SweetRice < 0.6.4 (fckeditor) Remote File Upload. SweetRice is a program for website management supporting web standards, SEO, and multiple databases like Mysql, Sqlite, PostgreSql. Vulnerability allows remote user to upload files with defined extensions without authentication


                                                ##############################################################################
#Title:             SweetRice &#60; 0.6.4 (fckeditor) Remote File Upload         #
#Vendor:            http://www.basic-cms.org                                 #
#Dork:              &#34;Powered By Basic CMS SweetRice&#34;                         #
##############################################################################
#AUTHOR:            ITSecTeam                                                #
#Email:             [email protected]                                        #
#Website:           http://www.itsecteam.com                                 #
#Forum :            http://forum.ITSecTeam.com                               #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability56.htm #
#Thanks:            r3dm0v3,[email protected],Pejvak,am!rkh@n                         #
##############################################################################

#DESCRIPTION (by vendor):#####################################################
SweetRice is a most simple program for website management.Perfect support web 
standards,easy to setup and use.best value is SEO.Support 3 kinds of 
database:Mysql,Sqlite,PostgreSql,support database time line.


#BUG:#########################################################################
file /_plugin/fckeditor/editor/filemanager/connectors/php/config.php:
 125: $Config[&#39;AllowedExtensions&#39;][&#39;File&#39;]	= array(&#39;7z&#39;, &#39;aiff&#39;, &#39;asf&#39;, &#39;avi&#39;, &#39;bmp&#39;, &#39;csv&#39;, &#39;doc&#39;, &#39;fla&#39;, &#39;flv&#39;, &#39;gif&#39;, &#39;gz&#39;, &#39;gzip&#39;, &#39;jpeg&#39;, &#39;jpg&#39;, &#39;mid&#39;, &#39;mov&#39;, &#39;mp3&#39;, &#39;mp4&#39;, &#39;mpc&#39;, &#39;mpeg&#39;, &#39;mpg&#39;, &#39;ods&#39;, &#39;odt&#39;, &#39;pdf&#39;, &#39;png&#39;, &#39;ppt&#39;, &#39;pxd&#39;, &#39;qt&#39;, &#39;ram&#39;, &#39;rar&#39;, &#39;rm&#39;, &#39;rmi&#39;, &#39;rmvb&#39;, &#39;rtf&#39;, &#39;sdc&#39;, &#39;sitd&#39;, &#39;swf&#39;, &#39;sxc&#39;, &#39;sxw&#39;, &#39;tar&#39;, &#39;tgz&#39;, &#39;tif&#39;, &#39;tiff&#39;, &#39;txt&#39;, &#39;vsd&#39;, &#39;wav&#39;, &#39;wma&#39;, &#39;wmv&#39;, &#39;xls&#39;, &#39;xml&#39;, &#39;zip&#39;) ;
 126: $Config[&#39;DeniedExtensions&#39;][&#39;File&#39;]		= array() ;

its not possible to upload shells but remote user can upload files with definned extensions without authentication.


#EXPLOIT:####################################################################
http://site.com/_plugin/fckeditor/editor/filemanager/connectors/test.html

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1