Singapore 0.9.9b Beta – Image Gallery Remote File Inclusion / Cross-Site Scripting

• Exploit Database
• 149 阅读

• 作者： TUNISIAN CYBER
  日期： 2014-02-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39087/
• 1 2 3 4 5 6 7 8 9 10

  source: https://www.securityfocus.com/bid/65420/info   Singapore Image Gallery is prone to a remote file-include vulnerability and a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.   An attacker can exploit these vulnerabilities to obtain potentially sensitive information, execute arbitrary script code in the context of the web server process, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or steal cookie-based authentication credentials and launch other attacks.   Singapore 0.9.9b and 0.9.10 are vulnerable; other versions may also be vulnerable.   http://www.example.com/thumb.php?gallery=./00000000000-764&height=100&image=[File Upload]