vendor:
MMS Gallery in PHP
by:
milw0rm.com
5.5
CVSS
MEDIUM
Remote File Disclosure
22
CWE
Product Name: MMS Gallery in PHP
Affected Version From: v1.0
Affected Version To: v1.0
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
MMS Gallery in PHP v1.0 (id) Remote File Disclosure Vulnerability
This vulnerability allows an attacker to disclose sensitive files on the server using a relative path traversal technique. By manipulating the 'id' parameter in the 'get_image.php' and 'get_file.php' scripts, an attacker can traverse directories and access files outside the intended directory.
Mitigation:
The vulnerability can be mitigated by implementing proper input validation and file path handling in the affected scripts. It is recommended to sanitize user input and restrict file access to only necessary directories.
