PT-2007-3996 · Sphp · Simple Php Scripts Gallery

Sekomirza · Publicado 2007-05-15 · Atualizado 2008-09-05 · CVE-2007-2679

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Scripts (sphp) gallery version 0.3

Description The issue allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the file exists function.

Recommendations For version 0.3, consider restricting access to the index.php file or the gallery parameter to minimize the risk of exploitation until a patch is available. Avoid using the gallery parameter with untrusted input in the index.php file.

Correção

Identificadores relacionados

CVE-2007-2679

Produtos afetados

Simple Php Scripts Gallery

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-2679 · Nota de Segurança
• http://secunia.com/advisories/24912 · Aviso do Fabricante
• http://attrition.org/pipermail/vim/2007-April/001536.html · Nota
• http://securityfocus.com/bid/23534 · Nota