Secunia

rgod has discovered a vulnerability in FCKeditor, which potentially can be exploited by malicious people to compromise a vulnerable system.

The problem is that it is possible to upload arbitrary files to a location inside the web root if the file extension does not match the list of denied file extensions. This can e.g. be exploited to upload and execute a malicious PHP script with the ".php.txt" file extension.

Successful exploitation requires that file uploads have been enabled in the "config.php" configuration file (not enabled by default).

The vulnerability has been confirmed in version 2.2 and has also been reported in version 2.0. Other versions may also be affected.

Solution
The vulnerability has been fixed in the SVN repository and will be fixed in the upcoming 2.3 version.

Provided and/or discovered by
rgod

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area