|
Description
|
|
Multiple vulnerabilities were identified in ImageVue, which could be exploited by remote attackers to disclose sensitive information or execute arbitrary commands and scripting code.
The first issue is due to access validation errors in the "dir.php" and "readfolder.php" scripts, which could be exploited by remote attackers to gain knowledge of sensitive information (e.g. list files in arbitrary directories).
The second vulnerability is due to an input validation error in the "index.php" script that does not validate the "bgcol" parameter, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser in the security context of an affected Web site.
The third flaw is due to an input validation error in the "admin/upload.php" script that does not properly validate file extensions, which could be exploited by attackers to upload malicious files to arbitrary directories.
|
