PT-2008-1903 · Minimal · Minimal Gallery

Houssamix · Published 2008-01-15 · Updated 2017-09-29 · CVE-2008-0259

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions minimal Gallery version 0.8

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This is achieved by using a .. (dot dot) in the thumbcat and thumb parameters of the mg/php/mg thumbs.php file.

Recommendations For minimal Gallery version 0.8, consider restricting access to the mg/php/mg thumbs.php file until a patch is available, and avoid using the thumbcat and thumb parameters with untrusted input.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-0259

Affected Products

Minimal Gallery

References · 5

• 🔥 https://exploit-db.com/exploits/4902 · Exploit
• 🔥 http://securityfocus.com/bid/27265 · Exploit
• http://secunia.com/advisories/28391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0259 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39649 · Note