ToendaCMS v.1.0.0 (FckEditor) File Upload Security Vulnerability

Description
Access to the FckEditor "/engine/js/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php" is not properly restricted. This can be exploited to upload and execute malicious PHP scripts.

Confirmed in version 1.0.0. Other versions may also be affected.

Impact
This can be exploited to upload arbitrary files to a location inside the web root (e.g. a PHP script).

References
Original Advisory
Product Homepage

View entire list of over 400 known Web Application Vulnerabilities and the specific technologies which they target. See Web Vulnerabilities in popular applications such as: WordPress, Tiki Wiki, PHPNuke, PHPMyAdmin, phpBB, Mambo, PHP-Fusion, Mantis, Invision Power Board

Get latest new web vulnerabilities via RSS