high7.5Public exploit code
CVE-2006-1839
PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary co…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPAlbum 0.2.2/0.2.3/4.1 - 'Language.php' File Inclusion2006-04-15 · webapps · php · Verified
Impact
PHP remote file inclusion vulnerability in language.php in PHP Album 0.3.2.3, when register_globals is enabled, allows remote attackers to execute arbitrary code via an FTP URL in the data_dir parameter, which satisfies the file_exists function call.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php Album | Php Album | Version 0.3.2.3 |
References
- NVD record
- CVE.org record
- http://retrogod.altervista.org/phpalbum_0323_incl_xpl.html
- http://secunia.com/advisories/19661
- http://www.osvdb.org/24741
- http://www.securityfocus.com/archive/1/431067/100/0/threaded
- http://www.securityfocus.com/bid/17526
- http://www.vupen.com/english/advisories/2006/1382
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25846
- http://retrogod.altervista.org/phpalbum_0323_incl_xpl.html
- http://secunia.com/advisories/19661
- http://www.osvdb.org/24741
- http://www.securityfocus.com/archive/1/431067/100/0/threaded
- http://www.securityfocus.com/bid/17526
- http://www.vupen.com/english/advisories/2006/1382
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25846