Description
Multiple vendor applications utilize FCKeditor. FCKeditor contains functionality to handle file uploads and file management. A remote attacker could use this functionality to upload malicious executable files on the system. To test file upload capabilities, Acunetix created a file named Acunetix_WVS_File_Upload_test.txt on the server.
Remediation
It is recommended to disable the file upload functionality in FCKeditor (if not required).
References
Related Vulnerabilities
WordPress Plugin ChimpMate-WordPress MailChimp Assistant Local File Inclusion (1.3.2)
WordPress Plugin Catch Themes Demo Import Arbitrary File Upload (1.7)
WordPress Plugin Gravity Upload Ajax Arbitrary File Upload (1.1)
WordPress Plugin N-Media Website Contact Form with File Upload Local File Inclusion (1.5)
WordPress Plugin Cms Pack TimThumb Arbitrary File Upload (1.3)