CVE-2007-5156 Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows....
HighCVSS 7.5
EPSS 8.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cardinal cms project cardinal cms | = 1.2 | No fix listed |
| redlinesoft lanai cms | <= 1.2.16 | No fix listed |
| sitex cms project sitex cms | = 0.7.3-beta | No fix listed |
| syntax cms project syntax cms | <= 1.3 | No fix listed |
| debian/moin(Debian:10) | < 1.5.8-4.1 | 1.5.8-4.1 |
References
- dev.fckeditor.net vendor-advisory
- dev.fckeditor.net vendor-advisory
- downloads.securityfocus.com broken-link
- 27123 third-party-advisory vendor-advisory
- 27174 third-party-advisory vendor-advisory
- 3182 exploit third-party-advisory
- sourceforge.net broken-link
- sourceforge.net broken-link
- 20070927 [waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS exploit mailing-list third-party-advisory vdb-entry
- 29422 third-party-advisory vdb-entry
- 30677 third-party-advisory vdb-entry
- ADV-2007-3464 third-party-advisory vdb-entry vendor-advisory
- ADV-2007-3465 third-party-advisory vdb-entry vendor-advisory
- www.waraxe.us exploit third-party-advisory
- lanai-upload-file-upload(42425) third-party-advisory vdb-entry
- syntaxcms-upload-file-upload(42733) third-party-advisory vdb-entry
- cardinal-upload-file-upload(44455) third-party-advisory vdb-entry
- 5618 exploit third-party-advisory vdb-entry
- 5688 exploit third-party-advisory vdb-entry