Fckeditor & amp; lt; = 2.4.2 For php Arbitrary File Upload Vulnerability

Lost.cq.cn

FCKeditor is an excellent HTML online editor. Severe security vulnerabilities in the locations where PHP uploads are processed
This allows you to upload arbitrary files.

In line 61 of fckeditor/editor/filemanager/upload/php/upload. php

$ SType = isset ($ _ GET [Type])? $ _ GET [Type]: File;

// Check if it is an allowed type.
If (! In_array ($ sType, array (File, Image, Flash, Media )))
SendResults (1, Invalid type specified );

// Get the allowed and denied extensions arrays.
$ ArAllowed = $ Config [AllowedExtensions] [$ sType];
$ ArDenied = $ Config [DeniedExtensions] [$ sType];

// Check if it is an allowed extension.
If (count ($ arAllowed)> 0 &&! In_array ($ sExtension, $ arAllowed ))
| (Count ($ arDenied)> 0 & in_array ($ sExtension,
$ ArDenied )))
SendResults (1, 202 );

The program obtains the Type variable from the $ _ GET array and then uses in_array to determine the Type.
However, in the config configuration file

$ Config [ForceSIngLeExtension] = true;

$ Config [AllowedExtensions] [File] = array ();
$ Config [DeniedExtensions] [File] =
Array (html, htm, php, php2, php3, php4, php5, phtml, pwml, inc, asp, aspx, ascx, jsp, cfm,

Cfc, pl, bat, exe, com, dll, vbs, js, reg, cgi, htaccess, asis );

$ Config [AllowedExtensions] [Image] =
Array (jpg, gif, jpeg, png );
$ Config [DeniedExtensions] [Image] = array ();

$ Config [AllowedExtensions] [Flash] = array (swf, fla );
$ Config [DeniedExtensions] [Flash] = array ();

The Media type is not controlled, causing users to upload arbitrary files.

Fix: Update to the latest version 2.5. Or add the file type restriction on Media in the config. php file.