PT-2006-2669 · Php · Phpwebgallery

Published 2006-04-10 · Updated 2018-10-18 · CVE-2006-1675

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHPWebGallery version 1.4.1

Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting (XSS) attacks. This is achieved by injecting malicious input via specific parameters to certain PHP files. The vulnerable parameters include cat, num, and search in "category.php", and slideshow, show metadata, and start in "picture.php".

Recommendations: For PHPWebGallery version 1.4.1, consider validating and sanitizing user input for the cat, num, search, slideshow, show metadata, and start parameters in the "category.php" and "picture.php" files to prevent XSS attacks. As a temporary workaround, restrict access to the "category.php" and "picture.php" files until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-1675

Affected Products

Phpwebgallery

References · 8

• 🔥 https://exploit-db.com/exploits/27587 · Exploit
• 🔥 https://exploit-db.com/exploits/27588 · Exploit
• 🔥 http://securityfocus.com/bid/17421 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1675 · Security Note
• http://vupen.com/english/advisories/2006/1301 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25733 · Note
• http://securityfocus.com/archive/1/430481/100/0/threaded · Note
• http://secunia.com/advisories/19610 · Note