CVE-2007-5156

描述

Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.

如何修補 CVE-2007-5156

要修補 CVE-2007-5156,請將受影響套件升級到下列已修補版本。

• Debian/moin—升級至 1.5.8-4.1 或更新版本

CVE-2007-5156 正在被利用嗎?

中等 — EPSS 為 8.0%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1.5.8-4.1

參考連結(19)

• ADVISORYdev.fckeditor.net/changeset/973
• ADVISORYdev.fckeditor.net/ticket/1325
• ADVISORYsecunia.com/advisories/27123
• ADVISORYsecunia.com/advisories/27174
• ADVISORYwww.vupen.com/english/advisories/2007/3464