From LOW to PWNED [10] Honorable Mention: FCKeditor

最新推荐文章于 2025-11-30 03:23:22 发布

转载最新推荐文章于 2025-11-30 03:23:22 发布 · 895 阅读

文章标签：

本文探讨了 FCKeditor 在多个系统中的广泛应用及其存在的安全漏洞，包括文件上传导致的安全隐患，并提供了几个具体的漏洞实例链接。此外，还分享了一个关于 FCKeditor 滥用的经典案例。

FCKeditor is bundled with seems-like everything (ColdFusion, Drupal plugins, WordPress plugins, other random CMSs) and has probably been responsible for countless hacks via file upload issues.

Examples:

http://www.exploit-db.com/exploits/12697/
http://www.exploit-db.com/exploits/15484/
http://www.exploit-db.com/exploits/17644/

Big O'l list on Exploit-DB

CVEdetails on FCKeditor.

LOW?

Actually most FCKeditors checks in Nessus I found were either Medium or High (hence honorable mention and not in the talk).

There is a good write-up of a classic case of FCKEditor abuse here:

http://secureyes.net/nw/assets/File-Upload-Vulnerability-in-FCKEditor.pdf

Google Dorks

inurl:/editor/filemanager/browser/default/connectors/[LANGUAGE]/connector.php