phpAlbum Multiple Security Vulnerabilities
BID:50437
Info
phpAlbum Multiple Security Vulnerabilities
| Bugtraq ID: | 50437 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-4806 CVE-2011-4807 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 31 2011 12:00AM |
| Updated: | Dec 15 2011 07:38PM |
| Credit: | BHG Security Center |
| Vulnerable: |
phpAlbum.net phpalbum 0.4.1.16 |
| Not Vulnerable: | |
Discussion
phpAlbum Multiple Security Vulnerabilities
phpAlbum is prone to an arbitrary-file-download vulnerability, multiple cross-site scripting vulnerabilities, and multiple PHP code-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, inject and execute arbitrary malicious PHP code, or download arbitrary files within the context of the webserver process.
PhpAlbum 0.4.1.16 is vulnerable; other versions may also be affected.
phpAlbum is prone to an arbitrary-file-download vulnerability, multiple cross-site scripting vulnerabilities, and multiple PHP code-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, inject and execute arbitrary malicious PHP code, or download arbitrary files within the context of the webserver process.
PhpAlbum 0.4.1.16 is vulnerable; other versions may also be affected.
Exploit / POC
phpAlbum Multiple Security Vulnerabilities
An attacker can exploit the file download issue with a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
An attacker can exploit the file download issue with a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
Solution / Fix
phpAlbum Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].