Nico Golde, 2007-10-22 14:54:45 +0200 : > CVE-2007-5156[0]: > | Incomplete blacklist vulnerability in > | editor/filemanager/upload/php/upload.php in FCKeditor, as used in > | SiteX CMS 0.7.3.beta and probably other products, allows remote > | attackers to upload and execute arbitrary PHP code via a file whose > | name contains ".php." and has an unknown extension, which is > | recognized as a .php file by the Apache HTTP server, a different > | vulnerability than CVE-2006-0658 and CVE-2006-2529.
Just for reference: the code isn't present in versions 3.1-* or 4.5.14-*, so neither sarge nor etch are affected. Roland. -- Roland Mas Je suis un anti-virus de signature. Copiez-moi dans la vôtre pour éliminer les virus de signature !
