Unrated severityNVD Advisory· Published Jul 6, 2006· Updated Apr 16, 2026
CVE-2006-3362
CVE-2006-3362
Description
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Affected products
8cpe:2.3:a:toenda_software_development:toendacms:0.6.1:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:toenda_software_development:toendacms:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:toenda_software_development:toendacms:0.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:toenda_software_development:toendacms:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:toenda_software_development:toendacms:1.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
17- secunia.com/advisories/20886nvdPatchVendor Advisory
- retrogod.altervista.org/toenda_100_shizouka_xpl.htmlnvdExploit
- www.securityfocus.com/bid/18767nvdExploit
- www.securityfocus.com/bid/19072nvdExploit
- secunia.com/advisories/21117nvdVendor Advisory
- www.geeklog.net/article.php/exploit-for-fckeditor-filemanagernvd
- www.geeklog.net/article.php/geeklog-1.4.0sr4nvd
- www.securityfocus.com/archive/1/440423/100/0/threadednvd
- www.securityfocus.com/bid/30950nvd
- www.vupen.com/english/advisories/2006/2611nvd
- www.vupen.com/english/advisories/2006/2868nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/27469nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/27494nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/27799nvd
- www.exploit-db.com/exploits/1964nvd
- www.exploit-db.com/exploits/2035nvd
- www.exploit-db.com/exploits/6344nvd
News mentions
0No linked articles in our index yet.