CVE-2006-0658
FCKeditor 2.0-2.2 - Unauthenticated Arbitrary File Upload via Extension Blacklist Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-0658. PoCs published by BlackHawk, rgod.
AI-analyzed exploit summary This exploit leverages an authentication bypass vulnerability in InoutMailingListManager <= 3.1 to upload a malicious PHP file, which then executes arbitrary commands on the target system. It also retrieves database credentials from the application's configuration file.
Description
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.
Exploits (2)
This exploit leverages an authentication bypass vulnerability in InoutMailingListManager <= 3.1 to upload a malicious PHP file, which then executes arbitrary commands on the target system. It also retrieves database credentials from the application's configuration file.
This exploit targets FCKEditor versions 2.0 to 2.2, allowing arbitrary file uploads via the PHP connector. It leverages misconfigurations in the `Config[DeniedExtensions][File]` array to upload a malicious shell, enabling remote command execution.