Unscored severity · published Jul 6, 2006
CVE-2006-3362
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geeklog · Geeklog
1.4.0; 1.4.0_sr1; 1.4.0_sr2; 1.4.0_sr3 · source: NVD
TO
Toendacms · Toenda Software Development
0.6.1; 0.6.2; 0.7; 1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3362
Exploit
http://retrogod.altervista.org/toenda_100_shizouka_xpl.html
Patch
http://secunia.com/advisories/20886
Vendor Advisory
http://secunia.com/advisories/21117
www.geeklog.net
http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager
www.geeklog.net
http://www.geeklog.net/article.php/geeklog-1.4.0sr4
www.securityfocus.com
http://www.securityfocus.com/archive/1/440423/100/0/threaded
More from Geeklog
4.8
CVE-2023-46058
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the…
4.8
CVE-2023-46059
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL…
4.8
CVE-2023-37787
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and…
4.8
CVE-2023-37786
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail…
–
CVE-2013-1470
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject…