Vulnerability in Ezonlinegallery
CVE-2006-7103
Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote attackers to (1) determine directory existence via a ".." in the album parameter in a show_album action to (a) ezgallery.php, which produces different responses depending on existence; and read arbitrary image files via a ".." in the album or (2) image parameter to (b) image.php.
EPSS: 0.019 (77.1th percentile) — read the EPSS interpretation.
Affected products
- Ezonlinegallery — versions 0.9, 1.0, 1.1
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_CONFIRM, URL Repurposed)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (Exploit, Patch, x_refsource_MISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)