|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
FCKeditor contains a flaw that allows a remote upload files to arbitrary locations on the server. This flaw exists because the application does not validate the 'Type' variable upon submission to the upload.php script. This could allow a user to create or overwrite any files on the server with the same level of access as the web server. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 2.3 Beta or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
FCKeditor
 |
2.0 |
2.2 |
2.3 Beta |
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
