CVE-2013-1469
Piwigo < 2.4.7 - Path Traversal via Install.php DL Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-1469. PoCs published by High-Tech Bridge SA, LiquidWorm.
AI-analyzed exploit summary The exploit demonstrates a CSRF vulnerability (CVE-2013-1468) allowing arbitrary PHP file creation and a path traversal vulnerability (CVE-2013-1469) enabling arbitrary file read/deletion in Piwigo 2.4.6. The PoC includes HTML/JS for CSRF and a direct URL for path traversal.
Description
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
Exploits (2)
The exploit demonstrates a CSRF vulnerability (CVE-2013-1468) allowing arbitrary PHP file creation and a path traversal vulnerability (CVE-2013-1469) enabling arbitrary file read/deletion in Piwigo 2.4.6. The PoC includes HTML/JS for CSRF and a direct URL for path traversal.
The exploit demonstrates a directory traversal vulnerability in Piwigo 2.4.6's install.php script, allowing arbitrary file read and delete operations via the 'dl' parameter. The PoC includes a sample URL to exploit the vulnerability.