Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

Summary of fckeditor vulnerabilities

2025-03-28 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Network Security >

Share

Shulou(Shulou.com)06/01 Report--

1. Construct the test.html upload page locally

FCKeditor-Connectors Tests function BuildBaseUrl (command) {var sUrl = document.getElementById ('cmbConnector'). Value +'? Command=' + command +'& Type=' + document.getElementById ('cmbType'). Value +' & CurrentFolder=' + encodeURIComponent (document.getElementById ('txtFolder'). Value); return sUrl;} function SetFrameUrl (url) {document.getElementById (' eRunningFrame'). Src = url; document.getElementById ('eUrl') [xss_clean] = url } function GetFolders () {SetFrameUrl (BuildBaseUrl ('GetFolders')); return false;} function GetFoldersAndFiles () {SetFrameUrl (BuildBaseUrl (' GetFoldersAndFiles')); return false;} function CreateFolder () {var sFolder = prompt ('Type the folder name:',' Test Folder'); if (! SFolder) return false; var sUrl = BuildBaseUrl ('CreateFolder'); sUrl + =' & NewFolderName=' + encodeURIComponent (sFolder); SetFrameUrl (sUrl); return false;} function OnUploadCompleted (errorNumber, fileName) {switch (errorNumber) {case 0: alert ('File uploaded with no errors'); break; case 201: GetFoldersAndFiles () Alert ('A file with the same name is already available. The uploaded file has been renamed to "+ fileName +'"); break; case 202: alert ('Invalid file'); break; default: alert (' Error on file upload. Error number:'+ errorNumber); break;} this.frames.frmUpload = this; function SetAction () {var sUrl = BuildBaseUrl ('FileUpload'); document.getElementById (' eUrl') [xss_clean] = sUrl; document.getElementById ('frmUpload'). Action = sUrl } Connector: ASP ASP.Net ColdFusion Lasso Perl PHP Python Current Folder Resource Type File Image Flash Media Invalid Type (for testing) Get Folders and Files URL:

Second, page summary

1. View the editor version

FCKeditor/_whatsnew.html

-

2. Version version 2.2

Add one after the uploaded file in Apache+linux environment. Break through! The test passed.

-

3.Version

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Network Security

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report