PT-2006-2830 · Php · Phpalbum

Publicado 2006-04-19 · Atualizado 2018-10-18 · CVE-2006-1839

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Album version 0.3.2.3

Description The issue allows remote attackers to execute arbitrary code via an FTP URL in the data dir parameter when register globals is enabled. This is due to the data dir parameter satisfying the file exists function call, which can lead to remote file inclusion.

Recommendations For PHP Album version 0.3.2.3, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the language.php file to minimize the risk of arbitrary code execution. Avoid using FTP URLs in the data dir parameter until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-1839

Produtos afetados

Phpalbum

Referências · 9

• 🔥 https://exploit-db.com/exploits/27643 · Exploit
• 🔥 http://retrogod.altervista.org/phpalbum_0323_incl_xpl.html · Exploit
• http://osvdb.org/24741 · Nota
• http://securityfocus.com/bid/17526 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1839 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1382 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25846 · Nota
• http://securityfocus.com/archive/1/431067/100/0/threaded · Nota
• http://secunia.com/advisories/19661 · Aviso do Fabricante