PT-2007-2537 · Phpwebgallery · Phpwebgallery

Simon Bonnard · Published 2007-02-26 · Updated 2018-10-16 · CVE-2007-1109

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Phpwebgallery version 1.4.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields, including the login or mail address field in "Register.php", or the search author, mode, start year, end year, or date type field in "Search.php".

Recommendations For Phpwebgallery version 1.4.1, avoid using the vulnerable fields in Register.php and Search.php until a patch is available. As a temporary workaround, consider restricting access to the Register.php and Search.php files to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1109

Affected Products

Phpwebgallery

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-1109 · Security Note
• http://secunia.com/advisories/24308 · Vendor Advisory
• http://osvdb.org/33762 · Note
• http://securityfocus.com/bid/22711 · Note
• http://osvdb.org/33761 · Note
• http://securityreason.com/securityalert/2298 · Note
• http://securityfocus.com/archive/1/461160/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32687 · Note