PT-2006-3411 · Unknown · Selectapix

Published 2006-05-19 · Updated 2008-09-05 · CVE-2006-2463

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SelectaPix versions 1.31 and earlier

Description The issue allows remote attackers to obtain the installation path via a certain request to "view album.php", which displays the path in an error message, possibly due to an invalid or missing parameter username or other variables.

Recommendations For SelectaPix versions 1.31 and earlier, as a temporary workaround, consider restricting access to the "view album.php" endpoint until a patch is available. Avoid using invalid or missing parameters in the request to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-2463

Affected Products

Selectapix

References · 2

• 🔥 http://securitytracker.com/id?1016085 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2463 · Security Note