vendor:
DomPHP
by:
Houssamix
5.5
CVSS
MEDIUM
Local Directory Traversal
22
CWE
Product Name: DomPHP
Affected Version From: 0.83
Affected Version To: 0.83
Patch Exists: YES
Related CWE:
CPE:
Platforms Tested:
DomPHP <= v0.83 Local Directory Traversal Vulnerability
The DomPHP script version 0.83 is vulnerable to a local directory traversal attack. An attacker can exploit this vulnerability by providing a crafted URL to the 'url' parameter in the 'index.php' script of the photoalbum module. By manipulating the 'url' parameter, an attacker can navigate to arbitrary directories on the server and access sensitive files.
Mitigation:
The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of DomPHP (v0.84) or later. Additionally, it is recommended to implement access controls and input validation to prevent directory traversal attacks.
