CVEvulnerability
CVE-2006-0658
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-02-13
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Description
Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.
Affected configurations
• fckeditor fckeditor 2.0
• fckeditor fckeditor 2.2
References
- http://retrogod.altervista.org/fckeditor_22_xpl.html Exploit
- http://secunia.com/advisories/18767 Vendor Advisory
- http://www.securityfocus.com/archive/1/424708 Exploit
- http://www.vupen.com/english/advisories/2006/0502 Vendor Advisory
- https://www.exploit-db.com/exploits/3702 www.exploit-db.com
- http://retrogod.altervista.org/fckeditor_22_xpl.html Exploit
- http://secunia.com/advisories/18767 Vendor Advisory
- http://www.securityfocus.com/archive/1/424708 Exploit
- http://www.vupen.com/english/advisories/2006/0502 Vendor Advisory
- https://www.exploit-db.com/exploits/3702 www.exploit-db.com