KINGCMS 5.0 Vulnerability _kingcms

1. The default path for KINGCMS 5.0 FCKeditor is admin/system/editor/fckeditor/editor/fckeditor. Html

Name the local horse hx.asp;jpg. Note that there is no dot in front of JPG.

OK now. In fact, to do the station combined FCKeditor this kind of editor. It's best to add a validation. Only Admin can access ... That's better.

2. Editor Path:/admin/system/editor/

How to use: Access to http://www.xxx.com/admin/system/editor/FCKeditor/editor/filemanager/connectors/asp/connector.asp? After command=createfolder&type=image&currentfolder=/qing.asp&newfoldername=qing.asp in/up_files/image/ Create a clear Qing.asp folder under the directory.

And then visit http://www.xxx.com/admin/system/editor/FCKeditor/editor/filemanager/browser/default/browser.html? Type=image&connector=.. /.. /connectors/asp/connector.asp, select the newly created qing.asp folder and upload a picture trojan, you can upload a picture containing a sentence content, and then use a Word client connection.

3. The system is also relatively fragile backstage, if you can successfully log in the background to take Webshell relatively simple, backstage has a webftp function, you can upload arbitrary files. The default database address is/db/king#content#management#system.mdb, and when downloaded, replace # with%23.

There are a lot of existence FCKeditor Editor's basic existence the vulnerability is more of a fckeditor loophole than a kingcms vulnerability.

Interim solution:

1. Change the background path admin to a different directory.
Methods: Modify the Admin directory name to any name, to prevent others from guessing the background, but note that after the installation process is completed, modify

2. FCKeditor Editor Path make changes
Method: Open the Config.asp file in the Page/system directory.
Find: Const KING_FCKEDITOR_PATH = "FCKeditor" must be modified, please also modify the Admin/system/editor directory under the name of FCKeditor name set here

3. Modifying the default database name is any other name, plus a few numbers.    Modified after: page/system/conn.asp. The name of the database link inside


Modified version of FCKeditor solution:
Modify the Commands.asp file in the \editor\filemanager\browser\default\connectors\asp as follows:


In the code:


' Get the uploaded file name.
sFileName = Ouploader.file ("NewFile"). Name
Sextension = Ouploader.file ("NewFile"). Ext

Then add the following statement:


' Add start limit upload type code

sFileName = Mid (Sfilename,1,instr (sFileName, ".") -1)
Dim Filterarray
Dim fix
Dim Fixstar
Fixstar=false
Filterarray=split ("bmp| Jpg| Jpeg| Gif| Png| rar| zip| Swf| wav| mid| WMA "," | ")" Allow upload type
For fix=0 to UBound (Filterarray)
If UCase (sextension) =filterarray (fix) Then
Fixstar=true
Exit for
Else
Fixstar=false
End If
Next
If Fixstar=false Then ' if not in upload type, pop-up window
sErrorNumber = "202"
Else
sfilename=sfilename& "." &sextension

' Add end

' The following is the original statement of the file
Soriginalfilename = sFileName
Dim ICounter
.......... ' Omit part of the code

If ouploader.errnum > 0 Then serrornumber = "202"
Exit do
End If
Loop

End If ' Add an if closing sentence here


End If
Set Ouploader = Nothing ' End