Error about "ewebeditor v6.0.0 Vulnerability"

Cast s Blog

Cast and yijian talk about this problem. yijian says to write an article and send it for your convenience.

Occasionally saw the ewebeditor v6.0.0 vulnerability: http://www.bkjia.com/Article/200902/31706.html

I tried to build a local platform.

I found this is an invalid article.

First, the remote file is uploaded through asp/upload. asp.

When the program is uploaded, asp is automatically filtered out. A GIF is generated directly, but the content in the GIF is an error page.

The reason is that attackers maliciously submit a non-image format!

 

In a word.

The remote Upload Vulnerability of ewebeditor v6.0.0 is incorrect!