PT-2007-3996 · Sphp · Simple Php Scripts Gallery

Sekomirza · Published 2007-05-15 · Updated 2008-09-05 · CVE-2007-2679

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Scripts (sphp) gallery version 0.3

Description The issue allows remote attackers to execute arbitrary PHP code via a UNC share pathname or a local file pathname in the gallery parameter, which is accessed by the file exists function.

Recommendations For version 0.3, consider restricting access to the index.php file or the gallery parameter to minimize the risk of exploitation until a patch is available. Avoid using the gallery parameter with untrusted input in the index.php file.

Fix

Related Identifiers

CVE-2007-2679

Affected Products

Simple Php Scripts Gallery

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-2679 · Security Note
• http://secunia.com/advisories/24912 · Vendor Advisory
• http://attrition.org/pipermail/vim/2007-April/001536.html · Note
• http://securityfocus.com/bid/23534 · Note