CVE-2007-3163 - Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2

CVE-2007-3163

Summary

Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to CVE-2006-0658.

References

Vulnerable Configurations

cpe:2.3:a:frederico_caldeira_knabben:fckeditor:2.4.2:*:*:*:*:*:*:*
cpe:2.3:a:frederico_caldeira_knabben:fckeditor:2.4.2:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 14-02-2024 - 01:17)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:P/A:N

refmap via4

bid	24510
confirm	http://sourceforge.net/project/shownotes.php?release_id=520159
misc	http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows/ http://www.bitchiller.de/?p=20
osvdb	37554
secunia	25719 25923
xf	fckeditor-data-file-upload(34982)

Last major update

14-02-2024 - 01:17

Published

11-06-2007 - 22:30

Last modified

14-02-2024 - 01:17