PT-2004-2322 · Unknown · Singapore Image Gallery Web Application

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1407

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: singapore Image Gallery Web Application version 0.9.10

Description: The issue allows remote attackers to read or delete arbitrary files. This can be achieved through directory traversal vulnerabilities, specifically by exploiting the showThumb method in thumb.php to read files or by exploiting admin.class.php to delete files.

Recommendations: For version 0.9.10, consider restricting access to the thumb.php and admin.class.php files until a patch is available. As a temporary workaround, avoid using the showThumb method in thumb.php and restrict the functionality of admin.class.php to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1407

Affected Products

Singapore Image Gallery Web Application

References · 6

• http://securityfocus.com/bid/11990 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1407 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18528 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18532 · Note
• http://security.org.sg/vuln/singapore0910.html · Note
• http://marc.info/?l=bugtraq&m=110323479715051&w=2 · Note