Description
Multiple vendor applications utilize FCKeditor. FCKeditor contains functionality to handle file uploads and file management. A remote attacker could use this functionality to upload malicious executable files on the system. To test file upload capabilities, Acunetix created a file named Acunetix_WVS_File_Upload_test.txt on the server.
Remediation
It is recommended to disable the file upload functionality in FCKeditor (if not required).
References
Related Vulnerabilities
WordPress Plugin LISL Last-Image Slider TimThumb Arbitrary File Upload (1.0)
Nginx PHP code execution via FastCGI
WordPress Plugin Insert or Embed Articulate Content into WordPress Directory Traversal (4.2999)
WordPress Plugin Shopping Cart & eCommerce Store Arbitrary File Upload (3.0.8)
WordPress Plugin BuddyPress Cover Arbitrary File Upload (2.1.4.2)