CVE:CVE-2007-5156
CNNVD:CNNVD-200710-002
FCKeditor是个人开发者的一款开源的专用于在网页上编辑HTML的编辑器。
FCKeditor的editor/filemanager/upload/php/upload.php存在不完全黑名单漏洞,用于SiteX CMS 0.7.3.beta以及可能的其他版本,远程攻击者 可以借助一个名称包含".php."的文件或被Apache HTTP服务器识别为一个.php文件的未知扩展名的文件上传并执行任意PHP指令。
solution:Upgrade cardinal_cms_project cardinal_cms to a higher version than 1.2,and avoid the version 1.2; Upgrade redlinesoft lanai_cms to a higher version than 1.2.16,and avoid the version (,1.2.16]; Upgrade sitex_cms_project sitex_cms to a higher version than 0.7.3:beta,and avoid the version 0.7.3:beta; Upgrade syntax_cms_project syntax_cms to a higher version than 1.3,and avoid the version (,1.3]