About FCKeditor all versian Arbitrary File Upload Vulnerability

At night, I saw a FCKeditor all versian Arbitrary File Upload Vulnerability on Weibo.

I am working on fckeditor using my framework recently.

Address: http://www.bkjia.com/Article/201108/99594.html

The result is basically meaningless (at least I didn't find it) after I verified the hole just now)

Even version 2.4 (the earliest version in version 2.4.x)

Either the File type Extension check is that the blacklist already contains htaccess

Either Image and Flash type Extension detection is whitelist

So if you really want to use this so-called exploit

In fact, we still need to use the Media type extension not verified vulnerability that has been published earlier.

In fact, it is the same as taking off your pants and farting .......

I didn't understand that this so-called hole is caused by exploit-db Verified.

 

From: syc blog