PT-2007-2850 · Php · Php Photo Album

Published 2007-03-14 · Updated 2024-08-07 · CVE-2007-1456

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Photo Album versions prior to 0.3.2.6

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the db file parameter in the common.php file. It is noted that versions 0.3.2.6 and 0.4.1beta do not contain this file, which may indicate the original researcher was referring to a different product.

Recommendations For PHP Photo Album versions prior to 0.3.2.6, consider updating to a version that does not contain the vulnerable common.php file or apply configuration changes to restrict access to the db file parameter. As a temporary workaround, consider disabling the common.php file until a patch is available.

Fix

Related Identifiers

CVE-2007-1456

Affected Products

Php Photo Album

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-1456 · Security Note
• http://securityfocus.com/archive/1/462802/100/0/threaded · Note
• http://securityfocus.com/archive/1/462559/100/0/threaded · Note
• http://securityreason.com/securityalert/2422 · Note
• http://attrition.org/pipermail/vim/2007-March/001432.html · Note
• https://t.me/cvenotify/89640 · Telegram Post