PT-2007-2872 · Mcgallery · Mcgallery

Piker · Publicado 2007-03-16 · Atualizado 2017-10-11 · CVE-2007-1478

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions McGallery version 0.5b

Description The issue allows remote attackers to read arbitrary files and obtain script source code. This is achieved via the filename parameter in the "download.php" API endpoint.

Recommendations For McGallery version 0.5b, consider restricting access to the download.php endpoint until a patch is available. As a temporary workaround, avoid using the filename parameter in the download.php endpoint to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-1478

Produtos afetados

Mcgallery

Referências · 5

• 🔥 http://securityfocus.com/bid/22989 · Exploit
• 🔥 https://exploit-db.com/exploits/3494 · Exploit
• http://vupen.com/english/advisories/2007/1003 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1478 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33004 · Nota