CVE-2010-2126

Snipe Gallery 3.1.5 - Remote Code Execution via cfg_admin_path Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2010-2126. PoCs published by Sn!pEr.S!Te Hacker.

AI-analyzed exploit summary The provided text describes a remote file inclusion vulnerability in Snipe Gallery versions 3.1.5 and prior, where unsanitized user input in the 'cfg_admin_path' parameter allows arbitrary remote file inclusion. However, no actual exploit code is present, only a description and example URL.

Description

Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_admin_path parameter to (1) index.php, (2) view.php, (3) image.php, (4) search.php, (5) admin/index.php, (6) admin/gallery/index.php, (7) admin/gallery/view.php, (8) admin/gallery/gallery.php, (9) admin/gallery/image.php, and (10) admin/gallery/crop.php.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Sn!pEr.S!Te Hacker · textwebappsphp
https://www.exploit-db.com/exploits/34017

The provided text describes a remote file inclusion vulnerability in Snipe Gallery versions 3.1.5 and prior, where unsanitized user input in the 'cfg_admin_path' parameter allows arbitrary remote file inclusion. However, no actual exploit code is present, only a description and example URL.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Snipe Gallery <= 3.1.5
No auth needed
Prerequisites: Remote file hosting with malicious PHP code · Target server with allow_url_include enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WRITEUP VERIFIED
by Sn!pEr.S!Te Hacker · textwebappsphp
https://www.exploit-db.com/exploits/34016

This is a vulnerability writeup describing a remote file inclusion (RFI) vulnerability in Snipe Gallery. It lacks actual exploit code but provides a proof-of-concept URL demonstrating the vulnerability.

Classification
Writeup 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: Snipe Gallery versions 3.1.5 and prior
No auth needed
Prerequisites: Remote file inclusion must be enabled on the server · Attacker must be able to host a malicious PHP file on a remote server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

EPSS 0.0829
EPSS Percentile 94.2%

Details

CWE
CWE-94
Status published
Products (1)
snipegallery/snipe_gallery 3.1.5
Published Jun 01, 2010
Tracked Since Feb 18, 2026