PT-2007-5511 · Bilder · Bilder Uploader

Published 2007-08-14 · Updated 2018-10-15 · CVE-2007-4326

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bilder Uploader version 1.3

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the config[root ordner] parameter to various PHP scripts, including "gruppen.php", "bild.php", "feed.php", "mitglieder.php", "online.php", and "profil.php".

Recommendations For Bilder Uploader version 1.3, consider restricting access to the config[root ordner] parameter in the affected PHP scripts until a patch is available. As a temporary workaround, avoid using the config[root ordner] parameter in the API endpoints related to the specified PHP scripts.

Fix

Related Identifiers

CVE-2007-4326

Affected Products

Bilder Uploader

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-4326 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35922 · Note
• http://osvdb.org/36445 · Note
• http://securityfocus.com/archive/1/475954/100/0/threaded · Note
• http://osvdb.org/36447 · Note
• http://vupen.com/english/advisories/2007/2836 · Note
• http://secunia.com/advisories/26399 · Note
• http://osvdb.org/36448 · Note
• http://osvdb.org/36446 · Note
• http://osvdb.org/36444 · Note
• http://securityreason.com/securityalert/2993 · Note
• http://osvdb.org/36443 · Note