PT-2009-5673 · Unknown · Image Gallery

The G0Bl!N · Publicado 2009-09-24 · Atualizado 2017-09-19 · CVE-2009-3366

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions An image gallery version 1.0

Description The issue allows remote attackers to list arbitrary directories via a .. (dot dot) in the path parameter in the navigation.php file.

Recommendations For version 1.0, consider restricting access to the navigation.php file or validating the path parameter to prevent directory traversal attacks. As a temporary workaround, restrict access to the vulnerable navigation.php file until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-3366

Produtos afetados

Image Gallery

Referências · 6

• 🔥 https://exploit-db.com/exploits/9636 · Exploit
• 🔥 http://exploit-db.com/exploits/9636 · Exploit
• 🔥 http://osvdb.org/57943 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3366 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53148 · Nota
• http://secunia.com/advisories/36680 · Aviso do Fabricante