This host is installed with Piwigo and is prone to cross site request forgery and path traversal vulnerabilities.

Successful exploitation will allow remote attackers to create arbitrary PHP file or to retrieve and delete arbitrary files in the context of the affected application. Impact Level: Application

Upgrade to Piwigo version 2.4.7 For updates refer to http://piwigo.org/releases/2.4.7

- Flaw in the LocalFiles Editor plugin, it does not require multiple steps or explicit confirmation for sensitive transactions. - Input passed via 'dl' parameter to install.php is not properly sanitized before being used.

Piwigo version 2.4.6 and prior

• http://osvdb.org/90357
• http://osvdb.org/90504
• http://seclists.org/bugtraq/2013/Feb/152
• http://www.exploit-db.com/exploits/24561
• http://www.htbridge.com/advisory/HTB23144

---

Updated on 2015-03-25