36455vdb entry
http://osvdb.org/36455 CVE-2007-4328
Bilder Galerie 1.0 - 'index.php' Remote File Inclusion
Record summary
CVE-2007-4328 has a selected CVSS score of 6.8; EIP currently links 1 catalogued exploit.
Description
Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) galerie.php, or (3) anzagien.php. NOTE: A later report states that 1.1 is also affected, but that the filename for vector 3 is anzeigen.php.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBBilder Galerie 1.0 - 'index.php' Remote File InclusionExploitDB exploitby RizgarNot analyzed1 file
References
1036456vdb entry
http://osvdb.org/36456 36457vdb entry
http://osvdb.org/36457 26400Third-party advisory
http://secunia.com/advisories/26400 2999Third-party advisory
http://securityreason.com/securityalert/2999 20070809 Mapos Bilder Galerie Version 1.0 Remote Command Execution Vulnerabilitymailing list
http://www.securityfocus.com/archive/1/475952/100/0/threaded 25256vdb entry
http://www.securityfocus.com/bid/25256 ADV-2007-2838vdb entry
http://www.vupen.com/english/advisories/2007/2838 bildergalerie-multiple-file-include(35923)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/35923 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2007-4328