Vulnerabilities > CVE-2006-2397 - Input Validation vulnerability in Gphotos 1.4/1.5

047910
CVSS 5.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE
network
gphotos
exploit available
NVD
Published: 2006-05-16
Updated: 2018-10-18

Summary

Multiple cross-site scripting (XSS) vulnerabilities in GPhotos 1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) rep parameter to (a) index.php or (b) diapo.php or (2) image parameter to (c) affich.php. NOTE: item 1a might be resultant from directory traversal.

Vulnerable Configurations

Part Description Count
Application
Gphotos
2

Exploit-Db

  • descriptionGphotos 1.4/1.5 diapo.php rep Parameter XSS. CVE-2006-2397 . Webapps exploit for php platform
    idEDB-ID:27865
    last seen2016-02-03
    modified2006-05-13
    published2006-05-13
    reporterMorocco Security Team
    sourcehttps://www.exploit-db.com/download/27865/
    titleGphotos 1.4/1.5 diapo.php rep Parameter XSS
  • descriptionGphotos 1.4/1.5 index.php rep Parameter XSS. CVE-2006-2397 . Webapps exploit for php platform
    idEDB-ID:27864
    last seen2016-02-03
    modified2006-05-13
    published2006-05-13
    reporterMorocco Security Team
    sourcehttps://www.exploit-db.com/download/27864/
    titleGphotos 1.4/1.5 index.php rep Parameter XSS
  • descriptionGphotos 1.4/1.5 affich.php image Parameter XSS. CVE-2006-2397. Webapps exploit for php platform
    idEDB-ID:27866
    last seen2016-02-03
    modified2006-05-13
    published2006-05-13
    reporterMorocco Security Team
    sourcehttps://www.exploit-db.com/download/27866/
    titleGphotos 1.4/1.5 affich.php image Parameter XSS

References