newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka...
Vulnerability Description
newimage.php in Eric Gerdes Crafty Syntax Image Gallery (CSIG) (aka PHP thumbnail Photo Gallery) 3.1g and earlier allows remote authenticated users to upload and execute arbitrary PHP code via a multipart/form-data POST with a .jpg filename in the fullimage parameter and the ext parameter set to .php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-1668
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.vupen.com/english/advisories/2006/1239
- http://www.securityfocus.com/bid/17379
- http://www.osvdb.org/24387
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25655
- http://bash-x.net/undef/exploits/crappy_syntax.txt
- http://bash-x.net/undef/adv/craftygallery.html
- https://www.exploit-db.com/exploits/1645
- http://secunia.com/advisories/19478
More from crafty syntax image gallery
View All →Affected Vendor
crafty syntax image gallery
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.