PT-2006-2488 · Webalbum · Webalbum

Rgod · Publicado 2006-03-29 · Atualizado 2017-10-19 · CVE-2006-1480

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: WebAlbum version 2.02

Description: The issue allows remote attackers to include arbitrary files and execute commands. This is achieved by injecting code into local log files via GET commands, and then accessing the log via a .. (dot dot) sequence and a trailing null (%00) byte in the skin2 COOKIE parameter.

Recommendations: For WebAlbum version 2.02, consider restricting access to the start.php file until a patch is available. As a temporary workaround, avoid using the skin2 COOKIE parameter with a .. (dot dot) sequence and a trailing null (%00) byte to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-1480

Produtos afetados

Webalbum

Referências · 7

• 🔥 http://secunia.com/advisories/19400 · Exploit
• 🔥 http://securityfocus.com/bid/17228 · Exploit
• 🔥 https://exploit-db.com/exploits/1608 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25443 · Nota
• http://osvdb.org/24160 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1480 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1108 · Nota