PT-2007-3965 · Monalbum · Monalbum

Dj7Xpl · Published 2007-05-14 · Updated 2017-10-19 · CVE-2007-2647

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Monalbum version 0.8.7

Description The issue allows remote authenticated users to inject arbitrary PHP code into the conf/config.inc.php file via various parameters in the admin/admin configuration.php script. The vulnerable parameters include gadm pass, gadm user, gcfgHote, gcfgPass, gcfgUser, gclassement rep, gcontour, gfond, ggd version, ghome, ghor, gimg copyright, glangage, gmenu visible, gmini hasard, gordre rep, gpage, gracine, grech inactive, grep mini, grepertoire, gsite, gslide, gtitre, guse copyright, gversion, gvert, or gcfgBase.

Recommendations For Monalbum version 0.8.7, as a temporary workaround, consider restricting access to the admin/admin configuration.php script until a patch is available. Additionally, avoid using the vulnerable parameters in the script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2007-2647

Affected Products

Monalbum

References · 8

• 🔥 http://0day.2600.ir/exploits/3903 · Exploit
• 🔥 https://exploit-db.com/exploits/3903 · Exploit
• http://secunia.com/advisories/25260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2647 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34250 · Note
• http://vupen.com/english/advisories/2007/1785 · Note
• http://osvdb.org/36013 · Note
• http://securityfocus.com/bid/23939 · Note