PHPAlbum Local File Include Vulnerability

Bugtraq ID:	15651
Class:	Access Validation Error
CVE:	CVE-2005-3948
Remote:	Yes
Local:	No
Published:	Nov 30 2005 12:00AM
Updated:	Nov 05 2008 05:15PM
Credit:	Discovered by rakstija r0t3d3Vil.
Vulnerable:	phpAlbum.net phpalbum 0.2.3 phpAlbum.net phpalbum 4.1
Not Vulnerable:	phpAlbum.net phpalbum 4.1.14

PHPAlbum Local File Include Vulnerability

phpAlbum is prone to a local file-include vulnerability.

An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process.

Note that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the webserver.

phpAlbum 0.2.3 and prior versions are vulnerable.

PHPAlbum Local File Include Vulnerability

No exploit is required.

The following proof-of-concept examples are available:

http://www.example.com/main.php?cmd=../
http://www.example.com/main.php?cmd=album&var1=../

PHPAlbum Local File Include Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

PHPAlbum Local File Include Vulnerability

References:

• Home Page (phpAlbum.net)
  
• phpAlbum Local file include vuln. (rakstija r0t3d3Vil)