CVE-2006-3362

23Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendepss 5.0%

probabilidade de exploração

5.0%top 9% das CVEs

exploração observada

nãonenhuma fonte reporta

3 exploit(s) público(s)

Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 3✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/1964 cve_referencewww.exploit-db.com/exploits/2035não verificado cve_referencewww.exploit-db.com/exploits/6344não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

http://retrogod.altervista.org/toenda_100_shizouka_xpl.html http://secunia.com/advisories/20886 http://secunia.com/advisories/21117 https://exchange.xforce.ibmcloud.com/vulnerabilities/27469 https://exchange.xforce.ibmcloud.com/vulnerabilities/27494 https://exchange.xforce.ibmcloud.com/vulnerabilities/27799 https://www.exploit-db.com/exploits/1964 https://www.exploit-db.com/exploits/2035 https://www.exploit-db.com/exploits/6344 http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager http://www.geeklog.net/article.php/geeklog-1.4.0sr4 http://www.securityfocus.com/archive/1/440423/100/0/threaded