CVE - CVE-2006-0658

CVE-ID
CVE-2006-0658	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package URL:http://www.securityfocus.com/archive/1/424708 EXPLOIT-DB:3702 URL:https://www.exploit-db.com/exploits/3702 MISC:http://retrogod.altervista.org/fckeditor_22_xpl.html SECUNIA:18767 URL:http://secunia.com/advisories/18767 VUPEN:ADV-2006-0502 URL:~~http://www.vupen.com/english/advisories/2006/0502~~ (Obsolete source)
Assigning CNA
MITRE Corporation
Date Record Created
20060213	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20060213)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)