CVE-2006-3362

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-06 · updated 2026-06-16

Description

Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.

Affected products

Geeklog: 1.4.0, 1.4.0_sr1, 1.4.0_sr2, 1.4.0_sr3
Toenda Software Development Toendacms: 0.6.1, 0.6.2, 0.7, 1.0

References

http://retrogod.altervista.org/toenda_100_shizouka_xpl.html
http://secunia.com/advisories/20886
http://secunia.com/advisories/21117
http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager
http://www.geeklog.net/article.php/geeklog-1.4.0sr4
http://www.securityfocus.com/archive/1/440423/100/0/threaded
http://www.securityfocus.com/bid/18767
http://www.securityfocus.com/bid/19072
http://www.securityfocus.com/bid/30950
http://www.vupen.com/english/advisories/2006/2611
http://www.vupen.com/english/advisories/2006/2868
https://exchange.xforce.ibmcloud.com/vulnerabilities/27469

Get alerted when CVE-2006-3362 or the next vulnerability affects your stack