Description
CKSource FCKeditor（现称CKEditor）是波兰CKSource公司的一套开源的、基于网页的文字编辑器。该编辑器具有轻量化、易于安装等特点。 在Fckeditor 2.3.0 - 2.4.3版本中，在upload.php文件中，检测上传的类型时，已检查却未定义拒绝后缀，导致可以上传任意后缀文件。
Fckeditor 2.4.3 PHP环境下任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.csdn.net/weixin_42582241/article/details/104439088
https://qkl.seebug.org/vuldb/ssvid-62283
https://github.com/ReAbout/web-sec/blob/master/exp/EXP-FCK.md
https://developer.aliyun.com/article/443590
https://jiwo.org/ken/detail.php?id=2801
https://misakikata.github.io/2019/05/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E/
https://www.cnblogs.com/mujj/articles/2019209.html
https://www.webshell.cc/260.html
https://lcx.cc/post/3115/
https://cloud.tencent.com/developer/article/1522652
https://www.exploit-db.com/exploits/15484
https://www.netspi.com/blog/technical-blog/network-pentesting/vulnerability-alert-fckeditor-arbitrary-file-upload/
https://www.acunetix.com/vulnerabilities/web/fckeditor-arbitrary-file-upload/
https://nvd.nist.gov/vuln/detail/CVE-2008-6178
https://blog.51cto.com/mrsun/204779