PT-2005-4939 · Mcgallery · Mcgallery Pro

Publicado 2005-12-14 · Atualizado 2011-03-08 · CVE-2005-4251

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mcGallery PRO versions 2.2 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id, start, and rand parameters to "show.php", and the album parameter to "index.php".

Recommendations For mcGallery PRO versions 2.2 and earlier, avoid using the id, start, rand, and album parameters in the affected API endpoints until the issue is resolved. As a temporary workaround, consider restricting access to the "show.php" and "index.php" files to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4251

Produtos afetados

Mcgallery Pro

Referências · 9

• 🔥 https://exploit-db.com/exploits/26809 · Exploit
• 🔥 https://exploit-db.com/exploits/26810 · Exploit
• 🔥 http://securityfocus.com/bid/15845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4251 · Nota de Segurança
• http://secunia.com/advisories/18039 · Nota
• http://osvdb.org/21720 · Nota
• http://osvdb.org/21719 · Nota
• http://pridels0.blogspot.com/2005/12/mcgallery-pro-vuln.html · Nota
• http://vupen.com/english/advisories/2005/2886 · Nota