Summary
The remote web server contains a PHP application that is prone to directory traversal attacks.
Description :
4Images is installed on the remote system. It is an image gallery management system.
The installed application does not validate user-input passed in the 'template' variable of the 'index.php' file. This allows an attacker to execute directory traversal attacks and display the content of sensitive files on the system and possibly to execute arbitrary PHP code if he can write to local files through some other means.
Solution
Sanitize the 'index.php' file.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2006-0899 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Apache Struts2 Redirection and Security Bypass Vulnerabilities
- AlienVault OSSIM Multiple Remote Code Execution Vulnerabilities
- AlienVault Open Source SIEM (OSSIM) 'timestamp' Parameter Directory Traversal Vulnerability
- Arkeia Appliance Path Traversal Vulnerability
- Atutor AChecker Multiple SQL Injection and XSS Vulnerabilities