PT-2006-2488 · Webalbum · Webalbum

Rgod · Published 2006-03-29 · Updated 2017-10-19 · CVE-2006-1480

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: WebAlbum version 2.02

Description: The issue allows remote attackers to include arbitrary files and execute commands. This is achieved by injecting code into local log files via GET commands, and then accessing the log via a .. (dot dot) sequence and a trailing null (%00) byte in the skin2 COOKIE parameter.

Recommendations: For WebAlbum version 2.02, consider restricting access to the start.php file until a patch is available. As a temporary workaround, avoid using the skin2 COOKIE parameter with a .. (dot dot) sequence and a trailing null (%00) byte to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-1480

Affected Products

Webalbum

References · 7

• 🔥 http://secunia.com/advisories/19400 · Exploit
• 🔥 http://securityfocus.com/bid/17228 · Exploit
• 🔥 https://exploit-db.com/exploits/1608 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1480 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25443 · Note
• http://osvdb.org/24160 · Note
• http://vupen.com/english/advisories/2006/1108 · Note