PT-2010-1628 · Phphotoalbum · Phphotoalbum

Wlhaan Hacker · Published 2010-04-27 · Updated 2017-08-17 · CVE-2009-4819

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPhotoalbum (affected versions not specified)

Description The issue concerns unrestricted file upload vulnerabilities in the upload.php file of PHPhotoalbum. Remote attackers can execute arbitrary code by uploading a file with a double extension, such as .php.pgif or .php.pjpeg, and then accessing it directly in the albums/userpics/ directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2009-4819

Affected Products

Phphotoalbum

References · 5

• 🔥 https://exploit-db.com/exploits/10584 · Exploit
• 🔥 http://exploit-db.com/exploits/10584 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4819 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54958 · Note
• http://securityfocus.com/bid/37436 · Note