SNS Vulnerability

ElkaGroup Image Gallery Arbitrary File Upload Vulnerability

Description

A vulnerability has been identified in ElkaGroup Image Gallery, which could be exploited by attackers to compromise a vulnerable web server. This issue is caused by an input validation error in the "upload.php" script when processing uploaded images, which could be exploited by attackers to upload malicious scripts and execute arbitrary commands with the privileges of the web server.

Vulnerable Products

Vulnerable Software:
ElkaGroup Image Gallery version 1.0 and prior

Solution

CVE

CVE-2009-1446

References

http://www.milw0rm.com/exploits/8514

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
Misc : Directory traversal - parameter starting with ../	3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL	3.2.0
Directory traversal using ..\..	3.2.0
Directory traversal	3.2.0
PHP : Remote file inclusion prevention : URL found as parameter	3.2.0
Directory traversal backward root folder	3.2.0

Risk level

Moderate

Vulnerability First Public Report Date

2009-04-23

Target Type

Server

Possible exploit

Local & Remote