OSVDB ID: 25631 Title: FCKeditor upload.php Type Variable Arbitrary File Upload |
Info |
|
|
Dates |
||||
|
|
Description |
FCKeditor contains a flaw that allows a remote upload files to arbitrary locations on the server. This flaw exists because the application does not validate the 'Type' variable upon submission to the upload.php script. This could allow a user to create or overwrite any files on the server with the same level of access as the web server. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Upgrade Exploit: Exploit Unknown Disclosure: OSVDB Verified, Vendor Verified OSVDB: Web Related |
Solution |
Upgrade to version 2.3 Beta or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |