CVEvulnerability
CVE-2006-3362
5.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-07-06
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
Description
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Affected configurations
• geeklog geeklog 1.4.0
• geeklog geeklog 1.4.0 sr1
• geeklog geeklog 1.4.0 sr2
• geeklog geeklog 1.4.0 sr3
• toenda software development toendacms 0.6.1
• toenda software development toendacms 0.6.2
• toenda software development toendacms 0.7
• toenda software development toendacms 1.0
References
- http://retrogod.altervista.org/toenda_100_shizouka_xpl.html Exploit
- http://secunia.com/advisories/20886 Patch, Vendor Advisory
- http://secunia.com/advisories/21117 Vendor Advisory
- http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager www.geeklog.net
- http://www.geeklog.net/article.php/geeklog-1.4.0sr4 www.geeklog.net
- http://www.securityfocus.com/archive/1/440423/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/18767 Exploit
- http://www.securityfocus.com/bid/19072 Exploit
- http://www.securityfocus.com/bid/30950 www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/2611 www.vupen.com
- http://www.vupen.com/english/advisories/2006/2868 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27469 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27494 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27799 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1964 www.exploit-db.com
- https://www.exploit-db.com/exploits/2035 www.exploit-db.com
- https://www.exploit-db.com/exploits/6344 www.exploit-db.com
- http://retrogod.altervista.org/toenda_100_shizouka_xpl.html Exploit
- http://secunia.com/advisories/20886 Patch, Vendor Advisory
- http://secunia.com/advisories/21117 Vendor Advisory
- http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager www.geeklog.net
- http://www.geeklog.net/article.php/geeklog-1.4.0sr4 www.geeklog.net
- http://www.securityfocus.com/archive/1/440423/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/18767 Exploit
- http://www.securityfocus.com/bid/19072 Exploit
- http://www.securityfocus.com/bid/30950 www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/2611 www.vupen.com
- http://www.vupen.com/english/advisories/2006/2868 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27469 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27494 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27799 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1964 www.exploit-db.com
- https://www.exploit-db.com/exploits/2035 www.exploit-db.com
- https://www.exploit-db.com/exploits/6344 www.exploit-db.com