4Images <= 1.7.1 index.php template Parameter Traversal Local File Inclusion

high Nessus Plugin ID 21020

Language:

Synopsis

The remote web server contains a PHP application that is prone to directory traversal attacks.

Description

4Images is installed on the remote system. It is an image gallery management system.

The installed application does not validate user-input passed in the 'template' variable of the 'index.php' file. This allows an attacker to execute directory traversal attacks and display the content of sensitive files on the system and possibly to execute arbitrary PHP code if he can write to local files through some other means.

Solution

Upgrade to 4Images version 1.7.2 or sanitize the 'index.php' file as advised by a forum post (see first URL).

Plugin Details

Severity: High

ID: 21020

File Name: 4images_171_directory_traversal.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 3/6/2006

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: www/PHP

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/26/2006

Reference Information

CVE: CVE-2006-0899

BID: 16855

Detections

Analytics