medium4.0Public exploit code
CVE-2013-1469
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a ..
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Piwigo 2.4.6 - Multiple Vulnerabilities2013-03-01 · webapps · php · Verified
- Piwigo 2.4.6 - '/install.php' Arbitrary File Read/Delete2013-02-19 · webapps · php · Verified
Impact
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Piwigo | Piwigo | through 2.4.6 Versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html
- http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html
- http://piwigo.org/bugs/view.php?id=0002843
- http://piwigo.org/forum/viewtopic.php?id=21470
- http://piwigo.org/releases/2.4.7
- http://www.exploit-db.com/exploits/24561
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
- https://www.htbridge.com/advisory/HTB23144
- http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html
- http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html
- http://piwigo.org/bugs/view.php?id=0002843
- http://piwigo.org/forum/viewtopic.php?id=21470
- http://piwigo.org/releases/2.4.7
- http://www.exploit-db.com/exploits/24561
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php
- https://www.htbridge.com/advisory/HTB23144