PT-2006-2669 · Php · Phpwebgallery

Publicado 2006-04-10 · Atualizado 2018-10-18 · CVE-2006-1675

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHPWebGallery version 1.4.1

Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is achieved by injecting malicious input via specific parameters to certain PHP files. The vulnerable parameters include cat, num, and search in "category.php", and slideshow, show metadata, and start in "picture.php".

Recommendations: For PHPWebGallery version 1.4.1, consider validating and sanitizing user input for the cat, num, search, slideshow, show metadata, and start parameters in the "category.php" and "picture.php" files to prevent XSS attacks. As a temporary workaround, restrict access to the "category.php" and "picture.php" files until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-1675

Produtos afetados

Phpwebgallery

Referências · 8

• 🔥 https://exploit-db.com/exploits/27587 · Exploit
• 🔥 https://exploit-db.com/exploits/27588 · Exploit
• 🔥 http://securityfocus.com/bid/17421 · Exploit
• http://vupen.com/english/advisories/2006/1301 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25733 · Nota
• http://securityfocus.com/archive/1/430481/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1675 · Nota de Segurança
• http://secunia.com/advisories/19610 · Nota