PT-2003-1158 · Duma · Duma Photo Gallery System

Published 2003-03-18 · Updated 2008-09-05 · CVE-2002-1411

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Duma Photo Gallery System (DPGS) version 0.99.4

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by using .. (dot dot) sequences in the id parameter.

Recommendations For Duma Photo Gallery System (DPGS) version 0.99.4, consider restricting access to the update.dpgs component until a patch is available. As a temporary workaround, avoid using the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-1411

Affected Products

Duma Photo Gallery System

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-06/0265.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1411 · Security Note
• http://securityfocus.com/bid/5081 · Vendor Advisory
• http://iss.net/security_center/static/9414.php · Vendor Advisory