PT-2007-3962 · Pinkcrow Designs · Magazin+1

Dj7Xpl · Publicado 2007-05-13 · Atualizado 2017-10-11 · CVE-2007-2643

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PinkCrow Designs Gallery or maGAZIn version 2.0

Description The issue allows remote attackers to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the phpThumb.php file, where an attacker can use a .. (dot dot) in the src parameter to access files outside the intended directory.

Recommendations For version 2.0, consider restricting access to the phpThumb.php file or the src parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the src parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-2643

Produtos afetados

Gallery

Magazin

Referências · 8

• 🔥 http://0day.2600.ir/exploits/3901 · Exploit
• 🔥 https://exploit-db.com/exploits/3901 · Exploit
• 🔥 http://securityfocus.com/bid/23943 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34240 · Nota
• http://osvdb.org/36016 · Nota
• http://vupen.com/english/advisories/2007/1782 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2643 · Nota de Segurança
• http://secunia.com/advisories/25262 · Aviso do Fabricante