CVE-2008-6178: Code Injection
First published: Thu Feb 19 2009(Updated: )
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wicked | =2.0rc2 | |
| Wicked | =2.0rc3 | |
| Wicked | =2.2 | |
| Wicked | =2.3beta | |
| Wicked | =2.4.3 | |
| PHPList | =2.10.1 | |
| PHPList | =2.10.2 | |
| PHPList | =2.10.3 | |
| PHPList | =2.10.4 | |
| PHPList | =2.10.5 | |
| PHPList | =2.10.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2008-6178?
CVE-2008-6178 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2008-6178?
To fix CVE-2008-6178, you should upgrade to a patched version of FCKeditor or apply relevant security patches provided by the vendors.
What type of vulnerability is CVE-2008-6178?
CVE-2008-6178 is an unrestricted file upload vulnerability that allows attackers to upload malicious PHP files.
Which applications are affected by CVE-2008-6178?
CVE-2008-6178 affects FCKeditor versions 2.0rc2, 2.0rc3, 2.2, as well as various versions of Phplist CMS.
Can CVE-2008-6178 lead to data theft?
Yes, CVE-2008-6178 can potentially lead to data theft as it allows remote attackers to execute arbitrary code on the server.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/phplist
- canonical/phplist
- version/phplist/2.10.6
- vendor/fckeditor
- canonical/wicked
- version/wicked/2.4.3
- version/phplist/2.10.1
- version/wicked/2.0rc3
- version/phplist/2.10.4
- version/wicked/2.2
- version/phplist/2.10.3
- version/phplist/2.10.2
- version/wicked/2.0rc2
- version/wicked/2.3beta
- version/phplist/2.10.5