PT-2012-5942 · Tinywebgallery · Tinywebgallery

Expl0!Ts · Published 2012-10-09 · Updated 2017-08-29 · CVE-2012-5347

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TinyWebGallery version 1.8.3

Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php.

Recommendations For TinyWebGallery version 1.8.3, consider restricting access to the command parameter in the affected files until a patch is available. As a temporary workaround, avoid using the command parameter in the inc/filefunctions.inc and info.php files to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2012-5347

Affected Products

Tinywebgallery

References · 6

• 🔥 https://exploit-db.com/exploits/18322 · Exploit
• 🔥 http://securityfocus.com/bid/51325 · Exploit
• 🔥 http://exploit-db.com/exploits/18322 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5347 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72157 · Note
• http://osvdb.org/82481 · Note