PT-2007-3962 · Pinkcrow Designs · Magazin+1

Dj7Xpl · Published 2007-05-13 · Updated 2017-10-11 · CVE-2007-2643

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PinkCrow Designs Gallery or maGAZIn version 2.0

Description The issue allows remote attackers to read arbitrary files. This is achieved by exploiting a directory traversal vulnerability in the phpThumb.php file, where an attacker can use a .. (dot dot) in the src parameter to access files outside the intended directory.

Recommendations For version 2.0, consider restricting access to the phpThumb.php file or the src parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the src parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-2643

Affected Products

Gallery

Magazin

References · 8

• 🔥 http://0day.2600.ir/exploits/3901 · Exploit
• 🔥 https://exploit-db.com/exploits/3901 · Exploit
• 🔥 http://securityfocus.com/bid/23943 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2643 · Security Note
• http://secunia.com/advisories/25262 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34240 · Note
• http://osvdb.org/36016 · Note
• http://vupen.com/english/advisories/2007/1782 · Note