FCKeditor Unspecified Arbitrary File Upload Vulnerability

Bugtraq ID:	26186
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 23 2007 12:00AM
Updated:	Oct 25 2007 05:06PM
Credit:	Pete Houston discovered this issue.
Vulnerable:	FCKeditor FCKeditor 2.4.3
Not Vulnerable:

FCKeditor Unspecified Arbitrary File Upload Vulnerability

FCKeditor is prone to an unspecified arbitrary-file-upload vulnerability because it fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

This issue affects FCKeditor 2.4.3 when file uploads are enabled in 'config.php'; other versions may also be vulnerable.

FCKeditor Unspecified Arbitrary File Upload Vulnerability

Attackers may exploit this issue through a browser.

FCKeditor Unspecified Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

FCKeditor Unspecified Arbitrary File Upload Vulnerability

References:

• FCKeditor Home Page (FCKeditor)
  
• [Vulz] eFileMan 7.x Multiple Vulnerabilities by Xcross8 ([email protected])