From LOW to PWNED [10] Honorable Mention: FCKeditor
来源:互联网 发布:知乎是什么样的软件 编辑:程序博客网 时间:2024/05/16 19:51
FCKeditor is bundled with seems-like everything (ColdFusion, Drupal plugins, WordPress plugins, other random CMSs) and has probably been responsible for countless hacks via file upload issues.
Examples:
http://www.exploit-db.com/exploits/12697/
http://www.exploit-db.com/exploits/15484/
http://www.exploit-db.com/exploits/17644/
Big O'l list on Exploit-DB
CVEdetails on FCKeditor.
LOW?
Actually most FCKeditors checks in Nessus I found were either Medium or High (hence honorable mention and not in the talk).
There is a good write-up of a classic case of FCKEditor abuse here:
http://secureyes.net/nw/assets/File-Upload-Vulnerability-in-FCKEditor.pdf
Google Dorks
inurl:/editor/filemanager/browser/default/connectors/[LANGUAGE]/connector.php
Examples:
http://www.exploit-db.com/exploits/12697/
http://www.exploit-db.com/exploits/15484/
http://www.exploit-db.com/exploits/17644/
Big O'l list on Exploit-DB
CVEdetails on FCKeditor.
LOW?
Actually most FCKeditors checks in Nessus I found were either Medium or High (hence honorable mention and not in the talk).
There is a good write-up of a classic case of FCKEditor abuse here:
http://secureyes.net/nw/assets/File-Upload-Vulnerability-in-FCKEditor.pdf
Google Dorks
inurl:/editor/filemanager/browser/default/connectors/[LANGUAGE]/connector.php
- From LOW to PWNED [10] Honorable Mention: FCKeditor
- From LOW to PWNED [8] Honorable Mention: Log File Injection
- From LOW to PWNED [11] Honorable Mention: Open NFS
- From LOW to PWNED [6] SharePoint
- From LOW to PWNED [12] Trace.axd
- From LOW to PWNED [3] JBoss/Tomcat server-status
- 浅析"Sublabel-Accurate Relaxation of Nonconvex Energies" CVPR 2016 Best Paper Honorable Mention
- Mention
- [深度学习论文笔记][CVPR 17 Best Paper Honorable Mention] Annotating Object Instances with a Polygon-RNN
- How to achieve low latency with the 10Gbps Ethernet
- Low latency answer from discussion forum
- To be a low-pitced technologist
- Upgrade from Windows 8 to Windows 10
- Ralph Lauren Tröja frequently extractors want to show you not to mention look at his or her's series
- how to make dword with high/low word or high/low byte
- FCKEditor
- FCKeditor
- fckeditor
- VC6 当MFC支持ATL
- 国嵌视频学习之UBOOT命令
- Chris Dixon:四类移动应用具备投资价值
- xpath简单语法
- vsFTPd常用功能之修改默认目录
- From LOW to PWNED [10] Honorable Mention: FCKeditor
- 如何快速查看oracle服务名连接的数据库的信息
- GameCanvas类
- AVL树的实现
- ff 插件
- From LOW to PWNED [8] Honorable Mention: Log File Injection
- 软件工程-----高内聚低耦合
- Hadoop---在window下的安装配置----基于cygwin的
- 使Javascript字符串换行