CKFinder 3 - File Browser Remote File Upload Vulnerability 2024

[ROOT]

=========================================
CKFinder 3 - File Browser  Remote File Upload Vulnerability
=========================================
 
Description :
 
This vulnerability could allow a remote attacker to bypass certain security restrictions.
 
This vulnerability allows an attacker to upload any file with an unauthorized extension due to insufficient authentication and bypassing security restrictions. Configured to allow only certain file extensions.
 
This vulnerability affects CKFinder for ASP, CKFinder for ASP.NET, CKFinder for ColdFusion, and CKFinder for PHP.
 
Decrease :
Not fixed (Be sure to install future updates from the vendor's website.)
 
Vulnerable software versions
 
CKFinder 3 - latest version
 
 
#Author: E1.Coders
 
#Dork : site: .il/assets/ckfinder/ckfinder.html
 
#Google Dark : https://www.google.com/search?q=site%3A+.ir%2Fassets%2Fckfinder%2Fckfinder.html&rlz=1C1CHBD_enUS1050US1050&oq=site%3A+.ir%2Fassets%2Fckfinder%2Fckfinder.html&aqs=chrome..69i57j69i58.4101j0j4&sourceid=chrome&ie=UTF-8
 
#Google Dark : https://www.google.com/search?q=site%3A+.il%2Fassets%2Fckfinder%2Fckfinder.html&rlz=1C1CHBD_enUS1050US1050&sourceid=chrome&ie=UTF-8
 
#Software Link: https://ckeditor.com/docs/ckfinder/ckfinder3/
 
#Cms Detector : https://whatcms.org/?s=rmhj.ir
 
#Cms Detector : https://www.wappalyzer.com/lookup/psyj.ir
 
#Exploit : http://target.com
 
#http://target.com/assets/ckfinder/ckfinder.html
 
#Select the "Upload" To use = txt . xml . exe . mp3 . and ..
 
#http://target.com/assets/ckfinder/ckfinder.html
 
#Show File : http://target.com/[path]/Your File.Your file extension