CVE-2006-0658 | BDVDB-2026-15102 Detail

Description#

Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://retrogod.altervista.org/fckeditor_22_xpl.html
http://www.vupen.com/english/advisories/2006/0502
http://www.securityfocus.com/archive/1/424708
http://secunia.com/advisories/18767
https://www.exploit-db.com/exploits/3702

Exploit#

https://www.exploit-db.com/exploits/3702

History#

Version 12006-02-13Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.