vendor:
4nAlbum
by:
SecurityFocus
7.5
CVSS
HIGH
Information Disclosure, Remote File Inclusion, Cross-Site Scripting, SQL Injection
20, 79, 89, 89
CWE
Product Name: 4nAlbum
Affected Version From: 0.92
Affected Version To: 0.92
Patch Exists: YES
Related CWE: N/A
CPE: 4nalbum
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005
4nAlbum Multiple Vulnerabilities
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input. There is an information disclosure issue with the 'displaycategory.php' script. There is a remote file inclusion vulnerability in the 'displaycategory.php' script. A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported. Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
Mitigation:
Input validation should be used to ensure that user-supplied data is properly sanitized. Additionally, the application should be kept up to date with the latest security patches.
