FCKeditor connector php任意檔案上傳漏洞
分享一下我老師大神的人工智慧教程！零基礎，通俗易懂！http://blog.csdn.net/jiangjunshow
也歡迎大家轉載本篇文章。分享知識，造福人民，實現我們中華民族偉大復興！
http://www.sebug.net/exploit/5799/
FCKeditor是一款開放原始碼的HTML文字編輯器。
FCKeditor的editor/filemanager/browser/default/connectors/php/connector.php模組中存在檔案上傳限制漏洞：
147. function FileUpload( $resourceType, $currentFolder )
148. {
149. $sErrorNumber = '0' ;
150. $sFileName = '' ;
151.
152. if ( isset( $_FILES['NewFile'] ) && !is_null( $_FILES['NewFile']['tmp_name'] ) )
153. {
154. $oFile = $_FILES['NewFile'] ;
155.
156. // Map the virtual path to the local server path.
157. $sServerDir = ServerMapFolder( $resourceType, $currentFolder ) ;
158.
159. // Get the uploaded file name.
160. $sFileName = $oFile['name'] ;
161. $sOriginalFileName = $sFileName ;
162. // Security fix by truzone 01-15-2006
163. //$sExtension = substr( $sFileName, ( strrpos($sFileName, '.') + 1 ) ) ;
164. //$sExtension = strtolower( $sExtension ) ;
165.
166. if(extension_loaded("mime_magic")){
167. $sExtension = mime_content_type($oFile['tmp_name']);
168. }else{
169. $sExtension = $oFile['type'];
170. }
171. // en of security fix by truzone 01-15-2006
172. global $Config ;
173.
174. $arAllowed = $Config['AllowedExtensions'][$resourceType] ;
175. $arDenied = $Config['DeniedExtensions'][$resourceType] ;
由於166-170行僅檢查了MIME型別的上傳請求，因此遠端攻擊者可以通過pht副檔名向Web伺服器上傳惡意指令碼。
給我老師的人工智慧教程打call！http://blog.csdn.net/jiangjunshow
