medium6.8Public exploit code
CVE-2009-4819
Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1)…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPhotoalbum - Arbitrary File Upload2009-12-21 · webapps · php · Verified
Impact
Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1) .php.pgif or (2) .php.pjpeg double extension, then accessing it via a direct request to the file in albums/userpics/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stoverud | Phphotoalbum | Versions 0.3, 0.4, 0.5 |