PT-2009-5674 · Unknown · Image Gallery

Published 2009-09-24 · Updated 2009-09-25 · CVE-2009-3367

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions An image gallery version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via the path parameter to "index.php" and "main.php", and the show parameter to "main.php".

Recommendations For An image gallery version 1.0, consider restricting access to the "index.php" and "main.php" API endpoints until a fix is available. As a temporary workaround, avoid using the path and show parameters in the affected API endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3367

Affected Products

Image Gallery

References · 5

• 🔥 https://exploit-db.com/exploits/9636 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3367 · Security Note
• http://secunia.com/advisories/36680 · Vendor Advisory
• http://osvdb.org/57945 · Note
• http://osvdb.org/57944 · Note