Ice Download Gallery Arbitrary File Upload Vulnerability

Bugtraq ID:	23463
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 12 2007 12:00AM
Updated:	Apr 12 2007 11:11PM
Credit:	LordGroove is credited with the discovery of this vulnerability.
Vulnerable:	Ice Download Gallery Ice Download Gallery 1.0
Not Vulnerable:

Ice Download Gallery Arbitrary File Upload Vulnerability

Ice Download Gallery is prone to an arbitrary-file-upload vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary script code in the context of the affected webserver process. This may help the attacker compromise the application; other attacks are possible.

This issue affects Ice Download Gallery 1.0; other versions may also be vulnerable.

Ice Download Gallery Arbitrary File Upload Vulnerability

Attackers can use the vulnerable application itself to exploit this issue.

Ice Download Gallery Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Ice Download Gallery Arbitrary File Upload Vulnerability

References:

• Ice Download Gallery Product Page (Ice Download Gallery)