SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

e107 My_Gallery Plugin Arbitrary File Download Vulnerability


Arrow  SecurityAlert : 3801
Arrow  CVE : CVE-2008-1702
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : No
Arrow  Credit : Jerome Athias
Arrow  Published : 09.04.2008

Arrow  Affected Software : e107 My_Gallery Plugin



Arrow  Advisory Content :  

e107 My_Gallery Plugin Arbitrary File Download Vulnerability

Release Date: 2008-03-25
Critical: Moderately critical
Impact: Exposure of system information, Exposure of sensitive information
Where: From remote
Solution Status: Unpatched
Software: My_Gallery v2.3 (plugin for e107) and prior
Link: http://plugins.e107.org/e107_plugins/psilo/psilo.php?artifact.208

Description:

A photo gallery for e107, powered by Highslide JS script. with random
gallery menu and navigation menu.

+ User interface for uploads images
+ Pre-moderation users download
+ Control Panel, can edit the name and description, delete and move
+ New comment system, it is now the most opulent gallery
+ New Front page
+ Added BBcode and a button

Vulnerability:
Jerome Athias has discovered a vulnerability in My_Gallery plugin for
e107, which can be exploited by malicious people to disclose sensitive
information.

The vulnerability is caused due to an input validation error in
dload.php when processing arguments passed to the "file" parameter. This
can be exploited to download arbitrary files from the affected system.

The vulnerability is confirmed in version 2.3. Other versions may also
be affected.

Solution:
Edit the source code to ensure that input is properly validated.

Dork: inurl:"e107_plugins/my_gallery"

Provided and/or discovered by:
Jerome Athias, JA-PSI
http://www.ja-psi.fr

Other References:
https://www.securinfos.info






Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc/fnmatch(3) DoS

Security Risk Medium- 2011-05-13

Allow attacker to denial of service apache 2.2.17 server
Apache RSS Apache Alert

» Apache HTTP Server Denial
   of Service Vulnerability

» Multiple Vendors
   libc/fnmatch(3) DoS (incl
   apache poc)

» Apache Continuum
   cross-site scripting
   vulnerability

» Apache Tomcat DoS
   Vulnerability
PHP RSS PHP Alert

» PHP Hashtables Denial of
   Service

» PHP 5.3.6 multiple null
   pointer dereference

» PHP 5.3.6 ZipArchive
   invalid use glob(3)

» libzip 0.9.3
   _zip_name_locate NULL
   Pointer Dereference (incl
   PHP 5.3.5)
ADT

Protect your family and valuables with Home Security Systems
Copyright © SecurityReason.com. All Rights Reserved.