0-day and repair of 360eshop secure online shop system

Content: 360eshop security online shop system adopts FCK compiler version: 2.6.4.1

Test Platform: IIS6

Test method:

-----------------------------------------------------------------------

The following testing methods may be offensive and only available for security research and teaching. Users are at your own risk!

-----------------------------------------------------------------------

 

Http://www.bkjia.com/expansion/fckeditor/editor/filemanager/connectors/test.html

 

Http://www.bkjia.com/expansion/fckeditor/editor/filemanager/connectors/uploadtest.html

 

These two pages are the key to the vulnerability. The format x. asa; jpg is successfully uploaded, and the file path is also available,

 

/Uploadfile/FCK_201109260018186311.ASA; JPG

 

If the keyword is not sent, find it by yourself.

Fixed: fckeditor upload problems. Refer to previous articles on this site.

Thank you: The HUC 08 team www.unhonker.com is dedicated to www.2cto.com.