FCKeditor 2.6.3 Directory Traversal

[Christian Foronda]

You may upload files and create folders without logging in the admin page. The bug can be exploited by uploading arbitrary script files (e.g. backdoor to the system) and execute it.

The files and folders that are created via this bug have the permission of "777".

example: ​http://yoursite.com/mambots/editors/fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=../../connectors/php/connector.php

Tested in:
CentOS-5.2
httpd-2.2.3
php-5.1.6
mysql-5.0.45
Joomla-1.0.15

Tried to install the nightly build but I guess it's for Joomla 1.5?

[Alfonso Martínez de Lizarrondo]

This is a problem in one integration of FCKeditor with Joomla. The default FCKeditor comes with the connectors disabled and states that before enabling it, proper security should be taken into account.

I've filed a bug about this issue many months ago, but it seems that they don't care.